Vercel Discloses and Helps Fix a Critical libheif AVIF Flaw

In August 2026, security researcher Hacktron reported what looked like a remote-code-execution (RCE) vulnerability in Next.js's image optimization feature. Vercel's investigation found the vulnerable code was not in Next.js itself, but upstream, in libheif, an AVIF image decoder also used by ImageMagick, WordPress, and sharp.

The bug was reachable through Next.js because its Image component calls the framework's image-optimization endpoint, which calls sharp, which calls libvips, which in turn uses libheif to decode AVIF images -- meaning a malicious AVIF image sent to that endpoint could trigger the flaw in libheif.

Vercel says it worked with Hacktron to reproduce the RCE against a current Next.js build, then rolled out a platform-wide mitigation on its Image Optimization Service within a day of the report, disabling AVIF optimization on August 13, before any upstream fix existed.

Fixing the underlying bug required coordinating disclosure across the maintainers of sharp, libvips, and libheif. Vercel says the Next.js team met with the libvips maintainer on August 19 to align on a path forward, and the libheif maintainer released a patched version, v1.23.2, six days later on August 25. Next.js shipped its own security release the same day, disabling AVIF optimization for self-hosted deployments, moving up an already-planned release by a day to do so.

Vercel credited Hacktron for the responsible disclosure and the sharp, libvips, and libheif maintainers for the upstream fix. The company also cited broader context: it says GitHub's private vulnerability reports grew from about 500 per week in January 2026 to about 3,000 per week in May, a trend it partly attributes to LLMs accelerating vulnerability research.