{"slug": "reproducing-disclosing-and-fixing-the-libheif-vulnerability-with-hacktron-and", "title": "Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers", "summary": "Hacktron reported a remote code execution vulnerability in August 2026 that traced to libheif, an AVIF image decoder used by Next.js, ImageMagick, WordPress, and sharp, rather than to Next.js itself. Vercel applied a platform-wide mitigation through its Image Optimization Service on August 13, and the libheif maintainer released v1.23.2 on August 25 to remediate the RCE, the same day Next.js published a security release that disabled AVIF optimization. The disclosure was coordinated across sharp, libvips, and libheif after Hacktron and Vercel reproduced the exploit with a working proof of concept on August 11-12.", "body_md": "In August 2026, [Hacktron](https://www.hacktron.ai/) reported what looked like a remote code execution (RCE) vulnerability in Next.js image optimization. Their investigation found that the vulnerable code was not in Next.js itself, but upstream in libheif, an AVIF image decoder used by Next.js, [ImageMagick](https://github.com/strukturag/libheif#software-using-libheif), [WordPress](https://make.wordpress.org/core/2024/08/15/automatic-conversion-of-heic-images-to-jpeg-in-wordpress-6-7/), [sharp](https://github.com/strukturag/libheif#software-using-libheif), and much of the web. \n\nShortly after Hacktron notified us, we worked with them to reproduce the RCE against a current Next.js build and disclose it to the maintainers of sharp, libvips, and libheif. We then deployed a platform-wide mitigation on Vercel and started working with the maintainers on a fix.\n\nNext.js image optimization lets applications resize and optimize images through the `<Image>` component (`next/image`). For AVIF images, the image-processing dependency chain is as follows: \n\n`<Image>` invokes `/_next/image`, \n\n`/_next/image` calls sharp\n\nsharp calls libvips\n\nlibvips uses libheif to decode the image\n\nThat meant the vulnerable code was not in Next.js, but it was still reachable through Next.js image optimization. A malicious AVIF image sent to the image optimization endpoint would invoke libheif through sharp and libvips.\n\nAs such, one obvious mitigation was to disable AVIF optimization in Next.js. Malicious AVIF images would then stop at the image optimization endpoint instead of being passed through sharp and libvips to libheif. The exploit would not propagate upstream.\n\nHowever, only mitigating Next.js, without an upstream fix, posed a disclosure problem.\n\nAfter we worked with Hacktron to successfully reproduce the issue, we rolled out a platform-wide mitigation on Vercel and reached out to the maintainers of sharp, libvips, and libheif to disclose the vulnerability and begin working on a fix.\n\nHere is the timeline:\n\n**August 11-12:** Hacktron reported the issue to Vercel; Hacktron and Vercel reproduced the RCE with a working proof of concept.\n\n**August 13:** Vercel applied a platform mitigation through its Image Optimization Service.\n\n**August 19:** The Next.js team met with the libvips maintainer and began coordination across sharp, libvips, and libheif.\n\n**August 24:** Next.js informed its security partners.\n\n**August 25:** Next.js published a security release that disabled AVIF optimization.\n\nThe Vercel security team contacted the maintainers of sharp and libvips by email, and opened coordination with libheif through a GitHub Security Advisory. Hacktron had also submitted vulnerability and exploit details to libheif. On August 19, the Next.js team met with the libvips maintainer and aligned on the path forward across sharp, libvips, and libheif. The libheif maintainer continued remediation through Hacktron’s GitHub Security Advisory.\n\nOn August 24, Next.js informed its security partners of the libheif vulnerability and its impact on Next.js (partner notifications are a routine part of Next.js’ security release process).\n\nOn August 25, six days after the August 19 meeting, the libheif maintainer released v1.23.2, which remediated the RCE.\n\nSecuring Vercel and its customers was straightforward: all Next.js image optimization requests on Vercel go through a central Image Optimization Service. Therefore, [we disabled AVIF optimization and resizing in that central service](https://vercel.com/changelog/nextjs-august-2026-security-release). Any incoming AVIF images were not passed to libheif for decoding and RCE was not possible on Vercel.\n\nProtecting self-hosted applications required a Next.js release. On August 25, [Next.js published a security release](https://nextjs.org/blog/august-2026-security-release) that had originally been planned to address a separate issue. After [coordinating an upstream fix](https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497), we bundled the AVIF mitigation into that release and shipped it a day earlier than planned. The release disabled AVIF optimization and resizing in Next.js; given that the patched libheif release was still propagating downstream, this was the most timely option. We also published a security advisory to communicate the issue’s severity.\n\nThe volume of OSS vulnerabilities discovered continues to increase, and the numbers are overwhelming:\n\nIn 2026, [the CVE program has published more than 35,000 CVEs](https://www.cve.org/about/Metrics).\n\nPrivate vulnerability reports on GitHub [grew from 500 per week in January to 3,000 per week in May](https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/).\n\nGitHub also reported [1,560 reviewed advisories in May 2026](https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/), the highest monthly volume in the advisory database’s history.\n\nAs LLMs accelerate vulnerability research, we expect to see more upstream vulnerabilities like the libheif RCE surface across the OSS ecosystem. There have been a higher number of Next.js security releases in recent months, and we expect that trend to continue as we mitigate new vulnerabilities that both we and the research community uncover.\n\nWe are committed to proactively finding vulnerabilities before attackers, responsibly disclosing everything we find, and collaborating with researchers and maintainers on fixes.\n\nThanks to Hacktron for responsibly disclosing the AVIF vulnerability, working with us to reproduce the issue, and coordinating with the upstream maintainers through remediation.\n\nWe also want to thank the maintainers of sharp, libvips, and libheif. Their work on the upstream fix made coordinated remediation possible across the image processing dependency chain.\n\nWe work with a talented set of researchers to secure Next.js and other open source frameworks through [Vercel's Open Source Bug Bounty](https://hackerone.com/vercel-open-source). Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.", "url": "https://wpnews.pro/news/reproducing-disclosing-and-fixing-the-libheif-vulnerability-with-hacktron-and", "canonical_source": "https://vercel.com/blog/reproducing-disclosing-and-fixing-the-libheif-vulnerability-with-hacktron-and-the-maintainers", "published_at": "2026-09-18 00:00:00+00:00", "updated_at": "2026-09-18 21:24:44.397599+00:00", "lang": "en", "topics": ["ai-crawlers", "ai-infrastructure", "ai-safety"], "entities": ["Hacktron", "Vercel", "Next.js", "libheif", "libvips", "sharp", "ImageMagick", "WordPress"], "alternates": {"html": "https://wpnews.pro/news/reproducing-disclosing-and-fixing-the-libheif-vulnerability-with-hacktron-and", "markdown": "https://wpnews.pro/news/reproducing-disclosing-and-fixing-the-libheif-vulnerability-with-hacktron-and.md", "text": "https://wpnews.pro/news/reproducing-disclosing-and-fixing-the-libheif-vulnerability-with-hacktron-and.txt", "jsonld": "https://wpnews.pro/news/reproducing-disclosing-and-fixing-the-libheif-vulnerability-with-hacktron-and.jsonld"}}