{"id":"GHSA-2xp9-vwfh-vxw4","title":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used","summary":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used","severity":"critical","cwe":["CWE-1395"],"vendor":"next","product":"next","ecosystem":"npm","affected":["next >= 10.0.0, < 15.5.24","next >= 16.0.0, < 16.3.3"],"patched":["next 15.5.24","next 16.3.3"],"published":"2026-09-08","updated":"2026-09-08","sourceUpdated":"2026-09-08T21:21:13Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-2xp9-vwfh-vxw4","references":[{"url":"https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497"},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4"},{"url":"https://github.com/vercel/next.js/pull/97875"},{"url":"https://github.com/vercel/next.js/pull/97931"},{"url":"https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3"},{"url":"https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2"},{"url":"https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998"},{"url":"https://github.com/vercel/next.js/releases/tag/v15.5.24"},{"url":"https://github.com/vercel/next.js/releases/tag/v16.3.3"},{"url":"https://github.com/advisories/GHSA-2xp9-vwfh-vxw4"}],"tags":["ghsa","npm"],"ingestedAt":"2026-09-08T22:12:30.968Z","slug":"GHSA-2xp9-vwfh-vxw4","body":"## Overview\n\nA vulnerability in the underlying `libheif` library used by `sharp` which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.\n\nUntil a fix has propagated, optimization of AVIF files is disabled.\n\n## Affected packages\n\n- `next >= 10.0.0, < 15.5.24`\n- `next >= 16.0.0, < 16.3.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `next 15.5.24`\n- `next 16.3.3`","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}