npm/next: critical
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
Action: Upgrade next to 15.5.24 or later.
npm i next@15.5.24npm i next@16.3.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 10.0.0 | 15.5.24 | - |
| 16.0.0 | 16.3.3 | - |
Fixed versions
| 15.5.24 | 16.3.3 |
Sources
- osv: GHSA-2xp9-vwfh-vxw4
- https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497
- https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4
- https://github.com/vercel/next.js/pull/97875
- https://github.com/vercel/next.js/pull/97931
- https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3
- https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2
- https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v15.5.24
- https://github.com/vercel/next.js/releases/tag/v16.3.3
published · modified · JSON