Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
First reported · 36d ago · 1 source
Crest summary — written by AI from the 1 source below; every figure is checked against them · model deepseek-chat
Summary
Hacktron reported a remote code execution flaw in Next.js image optimization, but the vulnerable code was traced upstream to libheif, an AVIF decoder used by Next.js, ImageMagick, WordPress and sharp.
Key facts
- Hacktron reported the issue in August 2026.
- The flaw was not in Next.js itself but in libheif.
- libheif is an AVIF image decoder.
- Next.js, ImageMagick, WordPress and sharp use libheif.
Why it matters
Projects relying on libheif through Next.js, ImageMagick, WordPress or sharp may need to track the upstream fix rather than patching their own code.
Companies
Technologies
- Next.jsframework
- AVIFstandard
- ImageMagickproduct
- libheiflibrary
- sharplibrary
Related on Crest
Matched by rule, not by AI: a repository linked in the coverage, or a technology or company in this event that Crest tracks.
Repositories
- ImageMagick/ImageMagickImageMagick is a free, open-source software suite for creating, editing, converting, and displaying images. It supports 200+ formats and offers powerful command-line tools and APIs for automation, scripting, and integration across platforms.Matches a named technology
- vercel/next.jsThe React FrameworkMatches a named technology
- vercel/nextjs-postgres-nextauth-tailwindcss-templateAdmin dashboard template.A named company’s project
- vercel/nextjs-postgres-auth-starterNext.js + Tailwind + Typescript + Drizzle + NextAuth + PostgreSQL starter template.A named company’s project
Original sources (1)
The report this event was built from. Crest of Tech keeps no article bodies: the full text is at each source.
- VercelOfficial · PrimaryReproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers · By Karim RahalRead at Vercel