Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers

In August 2026, researcher Hacktron reported a remote code execution vulnerability reachable through Next.js image optimization, tracing the issue to the upstream libheif AVIF decoder rather than Next.js itself. Because Next.js processes AVIF images through sharp and libvips, malicious files could reach the vulnerable library, prompting Vercel to disable AVIF optimization centrally on August 13 and Next.js to release a self-hosted mitigation on August 25. Vercel, Hacktron, and the maintainers of sharp, libvips, and libheif coordinated disclosure and remediation, with libheif version 1.23.2 addressing the underlying flaw. The incident highlights the security implications of widely shared open-source dependency chains, as well as growing vulnerability-report volumes that organizations attribute partly to increasingly effective automated and LLM-assisted research.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.