Security Digest · Critical advisory (no CVE assigned)
GHSA-2xp9-vwfh-vxw4: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.
CVSS 9.5 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
npm audit (or: npm ls <package>). - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| npm | next | >= 10.0.0, < 15.5.24 | 15.5.24 |
| npm | next | >= 16.0.0, < 16.3.3 | 16.3.3 |
Details
A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.
Until a fix has propagated, optimization of AVIF files is disabled.
CVSS: 9.5 (v4.0) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Sources and references
- GitHub Advisory GHSA-2xp9-vwfh-vxw4 github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com