In plain language
What this advisory means
A critical security issue was found in Next.js and the libheif image processing library used by it. This flaw lets attackers supply a specially crafted image file that can run malicious code inside the application without needing to log in. While Google Cloud's own infrastructure is safe, customers running Next.js apps on Google Cloud services like Cloud Run, GKE, or App Engine need to act to protect their workloads.
Technical explanation
How the issue affects the environment
The vulnerability arises during the image optimization process in Next.js, which uses the libheif library to handle HEIF/AVIF image formats. The libheif processing of "clean aperture boxes" in these images is flawed, creating conditions where an attacker can achieve remote code execution (RCE) by submitting maliciously crafted image files to the application. This vulnerability is unauthenticated, meaning no user credentials are required to exploit it.
Operational impact
Why teams should care
If vulnerable Next.js applications on Google Cloud are exploited, attackers can execute arbitrary code within the app's runtime context. This could lead to data breaches, service disruption, or further compromise of customer workloads. However, the core Google Cloud infrastructure remains unaffected, so the risk is limited to customer environments running vulnerable versions of Next.js or using unpatched libheif versions.
Immediate action
Customers should manually update their Next.js deployments by specifying version 16.3.3 or 15.5.24 or later in their package.json files. For users of libheif, monitor for OS-level updates and rebuild container base images with those patches. After upgrading, redeploy workloads to ensure running containers use the fixed versions.
Affected and fixed releases
Temporary risk reduction
The official bulletin does not specify a workaround. Immediate upgrade and redeployment of Next.js and libheif components are recommended.
Evidence and validation checklist
- Next.js image optimization component is vulnerable to crafted HEIF/AVIF images due to libheif processing flaw.
- Google Cloud infrastructure itself is not directly vulnerable.
- Customer workloads running Next.js on Google Cloud services may be affected.
- Manual upgrade to Next.js versions 16.3.3 or 15.5.24 or later is required.
- Monitoring and patching of libheif upstream OS packages is advised.
- Vulnerabilities tracked as GHSA-2xp9-vwfh-vxw4 and GHSA-g89c-p67h-r497.
Authoritative reference
Google Cloud Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.