From the source
From the source
Vercel details how a libheif RCE was found, mitigated, and fixed across the image-processing chain.
Vercel describes how Hacktron discovered a remote code execution vulnerability in libheif, an AVIF decoder used by Next.js and other software.
Vercel applied a platform-wide mitigation, coordinated with maintainers of sharp, libvips, and libheif, and released a Next.js security update that disabled AVIF optimization.
The libheif maintainer released version 1.23.2 to fix the RCE.
From the source
In August 2026, Hacktron reported what looked like a remote code execution (RCE) vulnerability in Next.js image optimization. Their investigation found that the vulnerable code was not in Next.js itself, but upstream in libheif , an AVIF image decoder used by Next.js, ImageMagick , WordPress , sharp , and much of the web.
vercel.com
