Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
Priority LOW 38CWE-1395Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
A vulnerability in the underlying `libheif` library used by `sharp` which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled.
Why it matters now
Fix Fixed next (npm): 15.5.24, 16.3.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | next (npm) | 10.0.0 to before 15.5.24 | 15.5.24 | Patch available | GHSA-2xp9-vwfh-vxw4 |
| — | next (npm) | 16.0.0 to before 16.3.3 | 16.3.3 | Patch available | GHSA-2xp9-vwfh-vxw4 |
- next (npm) Vendor— Affected 10.0.0 to before 15.5.24 Fixed in 15.5.24 Patch available GHSA-2xp9-vwfh-vxw4
- next (npm) Vendor— Affected 16.0.0 to before 16.3.3 Fixed in 16.3.3 Patch available GHSA-2xp9-vwfh-vxw4
Remediation
- Fix · GHSA-2xp9-vwfh-vxw4 next (npm) Fixed in 15.5.24 Advisory →
- Fix · GHSA-2xp9-vwfh-vxw4 next (npm) Fixed in 16.3.3 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-2xp9-vwfh-vxw4
References
Other 10
- https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497
- https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4
- https://github.com/vercel/next.js/pull/97875
- https://github.com/vercel/next.js/pull/97931
- https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3
- https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2
- https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v15.5.24
- https://github.com/vercel/next.js/releases/tag/v16.3.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences