Khoury College of Computer Sciences
CS 4550 / CS 5610 · Web Development · Fall 2026
libheif AVIF RCE: from Next.js image opt to upstream fix
- Next.js
- Security
- Course
Instructor-curated digest, not original reporting. Each post paraphrases a public article and links to the original source.
On September 18, 2026, Karim Rahal wrote up how Vercel reproduced, disclosed, and helped fix a libheif remote-code-execution bug that first showed up as an apparent Next.js image-optimization RCE. Hacktron reported the issue; the root cause was the upstream AVIF decoder. The request path was next/image to /_next/image to sharp to libvips to libheif.
The timeline in the post is August 11-12 for the report and reproduce, August 13 for a Vercel platform mitigation that disabled AVIF on the Image Optimization Service, August 19 for coordination with libvips, August 24 for partner notification, and August 25 for the Next.js security release that disabled AVIF optimization. The same day, libheif v1.23.2 remediated the RCE. Self-hosted apps needed that Next.js release; Vercel-hosted apps were mitigated earlier at the platform layer. The write-up notes rising open-source vulnerability volume in 2026 and credits Hacktron plus the sharp, libvips, and libheif maintainers.
The image-optimization chain starts in the Next.js app you set up in Chapter 1; the original Vercel post has the timeline, and this write-up is separate from the August 2026 security release.
Related in the book: Chapter 1