Vercel releases Next.js security updates to patch critical AVIF vulnerability

Vercel has released security updates for Next.js, specifically versions 16.3.3 and 15.5.24, to address critical vulnerabilities that could allow unauthenticated remote code execution.

One major flaw, carrying a CVSS score of 9.5, originates from a dependency rather than the Next.js framework itself. The issue lies within the C library libheif, which is used by the sharp Node package to optimize images. A specially crafted AVIF file can trigger a buffer overflow by forcing the library to process two alpha layers of different bit depths. This causes approximately 16 KB of data to be written outside the reserved memory buffer, allowing attackers to gain control.

To mitigate this risk, the latest Next.js updates disable AVIF optimization by default. This workaround will remain in place until a permanent fix is implemented in the upstream libheif project. Users who have manually enabled AVIF optimization in their next.config.js settings are particularly at risk if they have not updated.