GHSA-2xp9-vwfh-vxw4Critical▾ MidnightNext.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.
Until a fix has propagated, optimization of AVIF files is disabled.
next >= 10.0.0, < 15.5.24next >= 16.0.0, < 16.3.3Upgrade to a patched release:
next 15.5.24next 16.3.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-75604Critical· 9.0Next.js is a React framework for building full-stack web applications
GHSA-2464-fhr4-w9xwCriticalNext.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
GHSA-vcvr-r3jv-pc5jCriticalNext.js: Remote Code Execution in next/og ImageResponse
CVE-2026-94482High· 8.2Next.js: Denial of Service in App Router using Server Actions
GHSA-673q-mjm6-r5xrCriticalNext.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
CVE-2026-64643MediumNext.js: Unauthenticated disclosure of internal Server Function endpoints