How the libheif RCE reached Next.js
Hacktron disclosed the finding in August 2026 as a potential remote code execution flaw in Next.js image optimization. Reproducing it against a current Next.js build showed the vulnerable code lived upstream in libheif, the AVIF decoder used by Next.js and also by sharp, ImageMagick, WordPress and a large part of the web.
AVIF handling in Next.js image optimization runs through a chain of dependencies rather than a single library:
<Image>invokes/_next/image/_next/imagecalls sharp- sharp calls libvips
- libvips uses libheif to decode the image
A malicious AVIF submitted to the image optimization endpoint therefore reached libheif through sharp and libvips, even though the flaw itself was never in Next.js. Disabling AVIF optimization in Next.js is an effective local mitigation: the image stops at the endpoint and never propagates upstream. It does not, however, repair the decoder, which leaves the disclosure problem unsolved for everything else that links against libheif.
Coordination and remediation timeline
After reproducing the RCE, Vercel rolled out a platform-wide mitigation and contacted the maintainers of sharp, libvips and libheif. sharp and libvips were reached by email; coordination with libheif ran through a GitHub Security Advisory, to which Hacktron had also submitted vulnerability and exploit details.
- August 11–12: Hacktron reported the issue to Vercel; a working proof of concept reproduced the RCE.
- August 13: Vercel applied a platform mitigation through its Image Optimization Service.
- August 19: The Next.js team met the libvips maintainer and began coordination across sharp, libvips and libheif.
- August 24: Next.js informed its security partners.
- August 25: Next.js published a security release that disabled AVIF optimization.
Six days after the August 19 alignment meeting, the libheif maintainer released v1.23.2, which remediated the RCE. Remediation continued through Hacktron's GitHub Security Advisory under the libheif maintainer.
Mitigating Vercel and self-hosted deployments
On Vercel, every Next.js image optimization request passes through a central Image Optimization Service, so AVIF optimization and resizing could be turned off there in one place. Incoming AVIF images are no longer handed to libheif for decoding, and RCE is not possible on the platform.
Self-hosted applications required a code release instead. The August 25 security release had originally been scheduled to address a separate issue; after the upstream fix was coordinated, the AVIF mitigation was bundled into it and the release shipped a day earlier than planned. That release disables AVIF optimization and resizing in Next.js — the timeliest option while the patched libheif build was still propagating downstream. A security advisory accompanied the release to communicate severity.
Why upstream flaws keep surfacing
Open source vulnerability volume continues to climb. The CVE program has published more than 35,000 CVEs in 2026. Private vulnerability reports on GitHub rose from 500 per week in January to 3,000 per week in May, and GitHub recorded 1,560 reviewed advisories in May 2026, the highest monthly figure in the advisory database's history.
As LLMs accelerate vulnerability research, more upstream flaws like the libheif RCE are expected to surface across the ecosystem, and Next.js security releases have already become more frequent. That trend is expected to continue.
Thanks to Hacktron for responsibly disclosing the AVIF vulnerability, working with us to reproduce the issue, and coordinating with the upstream maintainers through remediation. Thanks as well to the maintainers of sharp, libvips and libheif, whose upstream work made coordinated remediation possible across the image processing dependency chain.
Researchers can contribute to the security of Next.js and other open source frameworks through Vercel's Open Source Bug Bounty. References: the Next.js August 2026 security release, the upstream libheif advisory, the Vercel security release changelog, and Just a rumor of a bug is enough to find a security exploit.
