Vercel and Next.js Disable AVIF Image Optimization to Mitigate libheif RCE Vulnerability
Vercel and Next.js disabled AVIF image optimization across their platforms to mitigate a remote code execution (RCE) vulnerability found in the upstream libheif library. This mitigation was implemented following the discovery of the vulnerability in August 2026, pending the release of patched upstream dependencies.
Verified State Diff
Impact & Verification Analysis
Vercel users utilizing Next.js Image Optimization and self-hosted Next.js applications processing AVIF images.
The change prevents a critical remote code execution vulnerability in the upstream libheif dependency from being exploited through the Next.js image processing pipeline.
Full Fact Overview
Following the discovery of a remote code execution (RCE) vulnerability in the libheif library—a dependency used by sharp and libvips for AVIF image processing—Vercel and the Next.js team implemented a platform-wide mitigation. Vercel disabled AVIF optimization and resizing within its central Image Optimization Service to prevent malicious payloads from reaching the vulnerable libheif decoder. Simultaneously, Next.js released a security update that disabled AVIF support to protect self-hosted applications. This action was coordinated with upstream maintainers, leading to the eventual release of libheif v1.23.2, which contains the permanent fix for the RCE.