Critical Unauthenticated Remote Code Execution Vulnerability in Next.js Image Optimization API
Summary
GHSA-2xp9-vwfh-vxw4: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used. Affects next across 2 version ranges.
>= 10.0.0, < 15.5.24
>= 16.0.0, < 16.3.3
Fixed in 15.5.24 or 16.3.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is a popular React framework that enables developers to build server-rendered applications with ease. It provides features such as automatic code splitting, server-side rendering, and static site generation. The framework utilizes the sharp library for image optimization, which relies on the libheif library for handling AVIF files. This vulnerability arises from a flaw in the libheif library, making Next.js susceptible to remote code execution when processing AVIF images.
Vulnerability Detail
A critical vulnerability exists in the Next.js framework due to an issue in the libheif library used by the sharp module for image optimization. This flaw allows an unauthenticated attacker to execute arbitrary code on the server when AVIF files are processed. The vulnerability has a CVSS score of 9.5, indicating a high severity level. Attackers can exploit this vulnerability to gain control over the server, potentially leading to data breaches or service disruptions.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 10.0.0, < 15.5.2415.5.24npm install next@15.5.24 -
>= 16.0.0, < 16.3.316.3.3npm install next@16.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, optimization of AVIF files has been disabled in Next.js until a fix is fully propagated. Users should refrain from using AVIF images for optimization until they have updated to a secure version.
Conclusion
The vulnerability in the Next.js framework poses a significant risk due to the potential for remote code execution when processing AVIF files. It is crucial for developers to update their Next.js installations to the latest patched versions to mitigate this risk. Until then, users should avoid using AVIF images for optimization.
See every vulnerability recorded for next →
FAQ
The CVSS score of this vulnerability is 9.5, indicating a critical severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions 10.0.0 to 15.5.23 and 16.0.0 to 16.3.2 are affected by this vulnerability.
As a temporary measure, avoid using AVIF images for optimization until you can update to a secure version.
More information can be found in the advisory database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2xp9-vwfh-vxw4/GHSA-2xp9-vwfh-vxw4.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for next.
