Junglewise Threat Intelligence

Next.js Image Optimization heap buffer overflow via AVIF

Severity: medium · CVSS 4 · Published 2026-09-08

Executive brief

Next.js uses a library called sharp for optimizing images on web servers, which relies on an underlying image decoder (libheif) to handle AVIF image files. A vulnerability in that decoder can be triggered by a specially crafted AVIF file, allowing an attacker to execute arbitrary code on the server without authentication. This could lead to complete compromise of a Next.js application and the server hosting it.

Technical details

A heap buffer overflow vulnerability exists in the libheif library's scale_nearest_neighbor() function when processing specially crafted HEIC/HEIF/AVIF files. The vulnerability is triggered by a chain of conditions: (1) transfer_channel_from_image_as() permits duplicate alpha channels in an image; (2) find_storage_for_channel() returns only the first matching channel, causing downstream code to misidentify buffer sizes; (3) scale_nearest_neighbor() allocates a destination buffer based on the first alpha channel's bit depth (8-bit), but when iterating over duplicate alphas with different bit depths (10-bit or 12-bit), it writes 16-bit values into the undersized 8-bit allocation; and (4) the iden (identity derivation) item type allows nested image references that create the duplicate-alpha condition. An attacker can craft a malicious AVIF file and supply it to any Next.js application using the image optimization API; no authentication or special configuration is required. Exploitation results in arbitrary code execution in the context of the application server. Next.js versions 10.0.0 through 15.5.23 and 16.0.0 through 16.3.2 are affected. Patches were released on 2026-08-26 as versions 15.5.24 and 16.3.3; initially AVIF optimization was disabled as a mitigation in earlier patches.

Affected products

  • Vercel Next.js >=10.0.0 <15.5.24; >=16.0.0 <16.3.3

Timeline

  • 2026-08-25: disclosed: Vulnerability disclosed in libheif and Next.js advisories
  • 2026-08-25: patched: Next.js v15.5.24 and v16.3.3 released with fix; AVIF optimization initially disabled
  • 2026-08-26: other: AVIF optimization re-enabled after sharp dependency bump to 0.35.4

References

Related threats