libheif AVIF RCE: from Next.js image opt to upstream fix

On September 18, 2026, Karim Rahal wrote up how Vercel reproduced, disclosed, and helped fix a libheif remote-code-execution bug that first showed up as an apparent Next.js image-optimization RCE. Hacktron reported the issue; the root cause was the upstream AVIF decoder. The request path was next/image to /_next/image to sharp to libvips to libheif.

The timeline in the post is August 11-12 for the report and reproduce, August 13 for a Vercel platform mitigation that disabled AVIF on the Image Optimization Service, August 19 for coordination with libvips, August 24 for partner notification, and August 25 for the Next.js security release that disabled AVIF optimization. The same day, libheif v1.23.2 remediated the RCE. Self-hosted apps needed that Next.js release; Vercel-hosted apps were mitigated earlier at the platform layer. The write-up notes rising open-source vulnerability volume in 2026 and credits Hacktron plus the sharp, libvips, and libheif maintainers.

Optional further reading for CS 4550 / CS 5610 — not required for labs or grades. This digest is the disclosure write-up and is distinct from the already-catalogued Next.js August 2026 security release on nextjs.org. Follow the original Vercel post for the chain and timeline rather than treating this summary as the advisory.

Read original: Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers — Vercel

Related in the book: Chapter 1