Next.js: Unauthenticated Remote Code Execution in Image Optimization API

Published September 8, 2026 GHSA-2xp9-vwfh-vxw4

A specially built AVIF image can make a vulnerable Next.js server run attacker commands. No login or user action is required.

Severity
Not scoredNo CVSS score recorded
Fix
Fixed in 15.5.24, 16.3.3Fix recorded 3 days ago
Affected versions
10.0.0 or newer, but before 15.5.24; 16.0.0 or newer, but before 16.3.3
Affects
next

How it works

  • The site must optimize an attacker-controlled AVIF image through Next.js.
  • Sharp then passes the image to its underlying libheif software.
  • Conflicting image-layer details make that software write outside its assigned workspace.
  • This can let the attacker run commands on the server.

What to do

Run npm ls next in the application's project directory. Versions from 10.0.0 through 15.5.23, or 16.0.0 through 16.3.2, are affected when AVIF optimization is used. Finding an affected version shows exposure, not proof of compromise.

Run this in the application environment you want to check:

npm ls next

Upgrade the 15.x branch to Next.js 15.5.24 or later. Upgrade the 16.x branch to 16.3.3 or later. Confirm the installed result with npm ls next.

Technical details

Next.js image optimization uses sharp, which relies on libheif for AVIF images. A deliberately constructed image can make libheif write beyond its assigned workspace, potentially allowing remote command execution. The advisory covers next npm releases from 10.0.0 before 15.5.24 and 16.0.0 before 16.3.3. Vercel temporarily disabled AVIF optimization while the corrected dependency propagated.

References

View Original Source