criticalnextGHSA-2xp9-vwfh-vxw4
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
Affected versions
>= 10.0.0, < 15.5.24, fixed in 15.5.24>= 16.0.0, < 16.3.3, fixed in 16.3.3
Published 2026-09-08. Last checked 2026-11-01. Read the source advisory