Remote code execution via Image Optimization when AVIF files are used
Original title: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
What happens
libheif, used by sharp, which Next.js uses for image optimization, has a vulnerability that allows remote code execution when AVIF files are optimized. No authentication is needed.
Who is affected
- Applications that use the Next.js image optimization API and optimize AVIF files.
Affected and fixed versions
| Affected | Fixed in |
|---|---|
>= 10.0.0, < 15.5.24 | 15.5.24 |
>= 16.0.0, < 16.3.3 | 16.3.3 |
What to do
- Upgrade Next.js to the fixed version in the table below.
- Note: in the fixed versions, AVIF optimization is disabled until the upstream fix has propagated.
Check yourself
- Run
npm ls next sharpand compare the Next.js version with the table below.
Sources
- GitHub Advisory Database GHSA-2xp9-vwfh-vxw4
- vercel/next.js GHSA-2xp9-vwfh-vxw4
- strukturag/libheif GHSA-g89c-p67h-r497
Rewritten from the original advisory; versions from the GitHub Advisory Database (CC-BY-4.0), updated 2026-10-29. Where they differ, the original advisory wins.