Critical RCE disclosed in self-hosted Next.js deployments

On August 27, Hacktron AI warned that its team had found a critical remote code execution vulnerability in Next.js, telling anyone self-hosting the framework to update immediately while saying Vercel's managed Next.js hosting was safe. The tweet promised technical details and a proof of concept later, without naming the bug.

What the bug turned out to be: a heap buffer overflow in libheif, the C/C++ library that Next.js reaches through the sharp image package when optimizing AVIF images. Vercel's own changelog credited the discovery to the Hacktron team, and the flaw was tracked as GHSA-2xp9-vwfh-vxw4, fixed in Next.js 15.5.24 and 16.3.3. Because the flaw sits in AVIF decoding rather than in Next.js itself, it only affected self-hosted servers processing AVIF uploads, matching Hacktron's original warning that Vercel-managed hosting was unaffected. The same libheif research effort Hacktron later published as HEIF Heist chained one of these bugs into an OpenAI employee account takeover.