---
title: "GHSA-2xp9-vwfh-vxw4: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used"
url: https://erroneo.us/security/ghsa/GHSA-2xp9-vwfh-vxw4/
description: "GHSA-2xp9-vwfh-vxw4 (critical, npm): Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used. A vulnerability in…"
type: advisory
section: "Security Digest"
date_published: 2026-09-08
date_modified: 2026-09-08
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-2xp9-vwfh-vxw4"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-2xp9-vwfh-vxw4: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

## Affected packages

- npm `next` >= 10.0.0, < 15.5.24 → fixed: 15.5.24
- npm `next` >= 16.0.0, < 16.3.3 → fixed: 16.3.3

## Details

A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled.

## Sources

- [GitHub Advisory GHSA-2xp9-vwfh-vxw4](https://github.com/advisories/GHSA-2xp9-vwfh-vxw4)
- [github.com](https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497)
- [github.com](https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4)
- [github.com](https://github.com/vercel/next.js/pull/97875)
- [github.com](https://github.com/vercel/next.js/pull/97931)
- [github.com](https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3)
- [github.com](https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2)
- [github.com](https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998)
- [github.com](https://github.com/vercel/next.js/releases/tag/v15.5.24)
- [github.com](https://github.com/vercel/next.js/releases/tag/v16.3.3)

---
Source page: https://erroneo.us/security/ghsa/GHSA-2xp9-vwfh-vxw4/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt