Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackGHSA-2xp9-vwfh-vxw4
By Mor Plada |
10 September 2026
Next.js Image Optimization AVIF processing enables unauthenticated RCE
Unauthenticated RCE in Next.js Image Optimization API when optimizing attacker-supplied AVIF images due to a vulnerable libheif used by sharp. Affects next `>=10.0.0, =16.0.0,