UpHeron
All vulnerabilities

npm

GHSA-2xp9-vwfh-vxw4

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Severity
Critical
Published
8 Sept 2026
Last changed
8 Sept 2026
Added to UpHeron
14 Oct 2026
Fixed in
15.5.24, 16.3.3
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
Next.jsnpm · osv:npm:next
  • From 10.0.0 before 15.5.24
  • From 16.0.0 before 16.3.3

References