Insecure Automated Optimizations Affecting next package, versions >=10.0.0 <15.5.24>=16.0.0-beta.0 <16.3.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-NEXT-19269945
- published26 Aug 2026
- disclosed26 Aug 2026
- creditUnknown
Introduced: 26 Aug 2026
New CVE NOT AVAILABLE CWE-1038 (opens in a new tab)How to fix?
Upgrade next to version 15.5.24, 16.3.3 or higher.
Overview
next is a react framework.
Affected versions of this package are vulnerable to Insecure Automated Optimizations through the image-optimizer path in packages/next/src/server/image-optimizer.ts. An attacker can execute code in the server-side image optimization process by supplying an AVIF image to a Next.js image optimization request. The vulnerable optimization path hands AVIF content to sharp/libheif for decoding, so a crafted AVIF file processed by the image API can trigger arbitrary code execution in the Next.js server. This can compromise the application server and expose or alter data handled by the process.
Workaround
Disable AVIF image optimization in Next.js image handling so AVIF files are not processed by the image optimizer and cannot trigger the vulnerable sharp/libheif decode path.