proomt

Search

Search posts, papers, and topics

All posts

VercelKarim Rahal4 min readintermediate

Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers

Read on vercel.com

Summary

Hacktron reported an RCE in libheif, an AVIF decoder used by Next.js image optimization. Vercel and Hacktron reproduced the issue, then coordinated with upstream maintainers (sharp, libvips, libheif) to deploy platform-wide mitigations and release fixes across the ecosystem.

  • An RCE was found in libheif, an AVIF image decoder, reachable via Next.js image optimization through sharp and libvips.
  • Vercel applied a platform-wide mitigation by disabling AVIF optimization in their central Image Optimization Service.
  • Coordinated disclosure involved Vercel, Hacktron, and maintainers of sharp, libvips, and libheif over a two-week period.
  • Next.js released a security update disabling AVIF optimization for self-hosted apps until the patched libheif propagated.

This post is important for engineers managing dependencies, especially in image processing, as it illustrates the challenges of securing complex open-source supply chains and the process of coordinated vulnerability disclosure.

7/10
nextjssecuritysupply chainvulnerabilityimage processingdisclosure

Related reading

  2. Fixing Server Component Bundle Leaks in Next.js with AST Linting

    Server‑only code can silently inflate client bundles in Next.js 15+ apps. The article shows how to spot leaks with @next/bundle-analyzer, prevent them by removing shared barrel files or adding the `server-only` guard, and enforce a deny‑list of server modules via a custom ESLint rule that scans the AST of files with a `'use client'` directive. The rule is wired into a CI bundle‑budget check using…

    SitePointsitepoint.com14 min

  3. When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

    Cloudflare’s Page Shield uses a graph‑neural‑network (GNN) to model JavaScript as a syntax‑tree graph, followed by a lightweight LLM for second‑opinion triage and an ensemble of frontier models for deep analysis. This pipeline caught eight malicious payloads across four distinct affiliate‑theft and backdoor techniques that traditional scanners missed, demonstrating the need for runtime, behavior‑…

    Cloudflarecloudflare.com21 minHN2

  4. This Week in Rust 666

    This issue of *This Week in Rust* (2026‑08‑26) aggregates community news: official Rust announcements (maintainers‑in‑residence, next‑gen trait solver, supply‑chain attack on arrayref, function‑overloading experiment), a Mozilla JPEG‑XL tooling update, several observations (AI‑assisted C/C++ rewrites, enum‑to‑word speedup, compilation metadata shaving, driver state handling, async vs sync for a r…

    Mozilla Automation Teamthis-week-in-rust.org9 min

  5. Migrating the GitHub Copilot runtime to Rust, using Copilot

    The Copilot agent runtime was rewritten from a 130‑k‑line TypeScript/Node.js codebase into a native Rust library (~830 k lines of Rust) to reduce startup latency, memory use, and improve reliability. The migration was done incrementally (in‑place) across 128 PRs, with AI‑generated code handling most of the work. The new runtime exposes a C ABI for in‑process embedding by all six Copilot SDK langu…

    GitHub Oldgithub.blog65 minHN188

  6. Why Does an NPM Math Library Need an Encrypted Loader?

    SafeDep discovered that several npm packages masquerading as mathjs contain an encrypted loader that only activates when a caller passes a particular matrix to the LU solver, using the matrix’s lower‑triangular factor as the decryption password. The loader decrypts and executes a multi‑stage remote‑access implant that talks to Slack, Telegram and a blockchain contract, and the same technique is r…

    Hacker News front pagesafedep.io10 minHN9627