libheif AVIF decoder RCE exposed Next.js, WordPress and ImageMagick stacks

The bug lived in the decoder, not the framework

According to the Vercel blog, a researcher going by Hacktron reported a suspected remote code execution flaw in Next.js image optimization on August 11, 2026. Over the following two days, Hacktron and Vercel built a working proof of concept against a current Next.js build and found that the vulnerable code was not part of Next.js at all. It sat further upstream, inside libheif, an open-source library that decodes AVIF images.

libheif occupies a spot at the bottom of a dependency chain that large parts of the web rely on. When a Next.js application uses the Image component, the request hits the /_next/image endpoint, which hands the file to sharp; sharp delegates to libvips, and libvips uses libheif to decode AVIF input. Vercel notes that the same library is also used by ImageMagick, WordPress and many other projects. A crafted AVIF image sent to an image optimization endpoint therefore reaches the vulnerable decoding code without any flaw existing in the framework itself.

How the disclosure unfolded

Vercel lays out the coordination timeline in its post. On August 13, within days of the initial report, the company applied a mitigation across its platform through its central Image Optimization Service. The Vercel security team then contacted the maintainers of sharp and libvips by email and opened coordination with the libheif maintainer through a GitHub Security Advisory; Hacktron had separately submitted vulnerability and exploit details to libheif. On August 19 the Next.js team met with the libvips maintainer to agree on a path forward across all three projects, after which the libheif maintainer continued remediation work through the advisory.

Next.js informed its security partners on August 24, which Vercel describes as a routine part of its security release process. On August 25, six days after the coordination meeting, the libheif maintainer published version 1.23.2, which remediates the remote code execution flaw.

What was mitigated, and where

Two layers of mitigation were needed. On Vercel's own platform, every Next.js image optimization request passes through a single Image Optimization Service, so Vercel disabled AVIF optimization and resizing there. Incoming AVIF files were no longer passed to libheif for decoding, which closed off the exploit path for hosted customers.

Self-hosted Next.js applications required a framework release. Next.js had already planned a security release for a separate issue, and the team bundled the AVIF mitigation into it, shipping it on August 25, a day earlier than originally scheduled. That release disables AVIF optimization and resizing in Next.js, a deliberate stopgap given that the patched libheif build had not yet propagated downstream through package ecosystems. Vercel also published a security advisory to communicate the severity of the issue.

Why it matters

This incident is a clear example of an upstream vulnerability with a wide blast radius. The flaw was found and reported through Next.js, but any stack that decodes AVIF with libheif, including WordPress, ImageMagick and direct users of sharp, was exposed until the library itself was patched. Framework-level mitigations such as disabling AVIF buy time, but the durable fix is upgrading libheif to v1.23.2 or later and refreshing the dependencies that bundle it.

Vercel also frames the episode as a sign of things to come. The company expects LLM-accelerated vulnerability research to surface more flaws like this across open-source ecosystems, and it points to the rising number of Next.js security releases in recent months as part of that trend. For maintainers and platform operators, the takeaway is that coordinated disclosure across an entire dependency chain, involving the researcher, the framework, the intermediary libraries and the vulnerable library itself, can move from initial report to upstream fix in roughly two weeks, as happened here between August 11 and August 25.