In plain language
What this advisory means
A critical security vulnerability was discovered in Next.js and the libheif image processing library. This flaw allows attackers to run harmful code by sending specially crafted image files to applications using Next.js for image optimization. Although Google Cloud's own backend systems are safe, customers running Next.js apps on Google Cloud services like Cloud Run, GKE, or App Engine might be at risk. To protect their workloads, customers should upgrade Next.js to versions 16.3.3 or 15.5.24 or later, and those using libheif should watch for system patches and update their container images accordingly.
Technical explanation
How the issue affects the environment
The vulnerability stems from how libheif processes 'clean aperture' boxes in HEIF/AVIF images, which Next.js uses during image optimization. Attackers can exploit this by submitting maliciously crafted image files, leading to unauthenticated Remote Code Execution (RCE) within the application’s runtime context. The exposed trust boundary includes customer application workloads deployed on Google Cloud infrastructure but not the infrastructure itself. The vulnerabilities, known as GHSA-2xp9-vwfh-vxw4 and GHSA-g89c-p67h-r497, affect specific versions of Next.js (prior to 16.3.3 and 15.5.24) and involve security flaws within libheif's image parsing, leading to arbitrary code execution risks.
Operational impact
Why teams should care
Organizations running Next.js applications on Google Cloud platforms risk unauthorized code execution inside their applications. This could lead to data breaches, service disruptions, or compromise of application integrity. Although this does not affect the Google Cloud infrastructure itself, the business impact is significant for customers' workloads, potentially resulting in operational and reputational damage if exploited.
Immediate action
Customers must manually upgrade their Next.js deployments to version 16.3.3, 15.5.24, or later by updating package.json and redeploying their workloads. For libheif, customers should monitor upstream operating system patches and rebuild/container base images accordingly. Redeployment is necessary to ensure patched versions are active in running containers.
Affected and fixed releases
Temporary risk reduction
The official source does not specify any workaround beyond upgrading Next.js and applying patches to libheif and rebuilding container images.
Evidence and validation checklist
- Official Google Cloud Security Bulletin GCP-2026-055
- References to vulnerabilities GHSA-2xp9-vwfh-vxw4 and GHSA-g89c-p67h-r497
- Advisory guidance on upgrading Next.js to 16.3.3 or 15.5.24 or later
- Recommendation to monitor and patch libheif dependencies and rebuild container images
- Explanation that Google Cloud infrastructure is not vulnerable but customer workloads are
Authoritative reference
Google Cloud Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.