Next.js AVIF RCE: your image optimizer runs libheif

Next.js shipped an emergency security release on August 25, 2026, and the interesting part is not the framework. The critical Next.js AVIF RCE did not originate in Next.js at all. It came from libheif, a C library that sharp links against, that the Image Optimization API calls when somebody uploads a .avif file. Three dependency hops from your package.json to an unauthenticated remote code execution on your box.

What actually happened

Per the official Next.js August 2026 security release, two critical-severity issues were fixed in v16.3.3 (Active LTS) and v15.5.24 (Maintenance LTS):

• GHSA-2xp9-vwfh-vxw4 — unauthenticated RCE in the Image Optimization API. The bug lives in libheif (GHSA-g89c-p67h-r497), reached through sharp, triggered when Next.js optimizes an attacker-controlled AVIF image. The patched releases disable AVIF optimization outright until the upstream fix lands. Your AVIF images will no longer be resized.
• CVE-2026-75604 — unauthenticated RCE on Windows-hosted servers, in apps using both the Pages Router and the App Router without Cache Components. Linux and macOS are unaffected. Next.js states there is no known workaround for affected Windows deployments.

Worth noting the sequencing: Next.js pre-announced this release the week before, then moved it forward after finding the libheif issue. The schedule held right up until an upstream dependency broke it.

Vercel confirmed that apps deployed on Vercel needed no action — the platform disabled AVIF across its managed Image Optimization service and runs Linux, so neither flaw applied. Self-hosted is a different story: npm install next@15.5.24 or npm install next@16.3.3, today.

Why it matters for your business

Two things fall out of this, and only one is "run npm install."

The first is that your image pipeline is native code with a network-facing entry point. Image Optimization takes a URL from a request, fetches bytes, and hands them to a C decoder. That is the classic memory-safety attack surface, and it sits behind a route most teams never think about as an endpoint. If your site accepts user-uploaded images and optimizes them, you have a decoder parsing hostile input on every upload.

The second is dependency depth. Nobody chose libheif. You chose Next.js, which chose sharp, which links libheif. When it broke, the fix had to propagate down the chain — and the interim answer was to turn the feature off. That is the honest cost of a deep dependency tree, and it is not an argument against using one. It is an argument for knowing what is in it. A package-lock.json you can generate an SBOM from and a patch path you have actually exercised beat a security policy document.

If you run Next.js on Windows, patch first and read second. That one has no mitigation.

Sources: Next.js — August 2026 Security Release, Vercel Changelog — Next.js August 2026 security release.