Last week we announced an upcoming security release for Next.js. Earlier today , we moved the release forward after identifying an additional critical severity vulnerability in one of our upstream dependencies.
Updates are now available in v16.3.3 (Active LTS) and v15.5.24 (Maintenance LTS) to address these issues. Please patch your Next.js dependencies to maintain the security of your applications.
A vulnerability in the underlying libheif library used by sharp can lead to unauthenticated remote code execution when Next.js optimizes an attacker-controlled AVIF image.
This is an excerpt. The full article is published by Next.js Blog.
Continue reading at Next.js Blog