Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

What it is

A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.

Until a fix has propagated, optimization of AVIF files is disabled.

How to check

1. Affected: next (npm) >= 10.0.0, < 15.5.24.
2. Affected: next (npm) >= 16.0.0, < 16.3.3.
3. Compare your installed version with the range above (command below).

How to fix

1. Upgrade next to 15.5.24 or later.
2. Upgrade next to 16.3.3 or later.

npm ls next

Sources

• GitHub Security Advisory GHSA-2xp9-vwfh-vxw4 ↗