Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
In August 2026, reported what looked like a remote code execution (RCE) vulnerability in Next.js image optimization. Their investigation found that the vulnerable code was not in Next.js itself, but upstream in libheif, an AVIF image decoder used by Next.js, , , , and much of the web.…
No discussion yet. Be the first to share your thoughts!