In August 2026, security firm Hacktron reported what appeared to be an RCE vulnerability in Next.js image optimization. The actual flaw lived upstream in libheif, an AVIF decoder used by Next.js, ImageMagick, WordPress, and sharp. The attack path is four layers deep: the Next.js Image component calls the optimization endpoint, which calls sharp, which calls libvips, which calls libheif to decode the image. A single malicious AVIF file traverses that entire chain.
Vercel reproduced the working exploit by August 12, applied a platform-wide mitigation on August 13 by disabling AVIF optimization in its central Image Optimization Service, and coordinated disclosure to the maintainers of sharp, libvips, and libheif. Six days after a cross-maintainer alignment meeting on August 19, libheif shipped v1.23.2 with the fix. Next.js published its own security release on August 25, disabling AVIF optimization for self-hosted deployments while the patched libheif propagated downstream. The full timeline, the coordination mechanics between four separate maintainer chains, and the disclosure tradeoffs of mitigating a single consumer without an upstream fix are where the real substance of this piece lives.
The broader signal here is volume: in 2026, the CVE program has published over 35,000 CVEs, private GitHub vulnerability reports scaled from 500 to 3,000 per week between January and May, and GitHub recorded 1,560 reviewed advisories in May alone, the highest in the advisory database's history. Vercel attributes accelerating discovery rates to LLMs lowering the cost of vulnerability research. More upstream dependency chain vulnerabilities like this one are coming, and how maintainers coordinate across those chains is an unsolved problem.
[READ ORIGINAL →]