disclosure

Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainersvercel.com

Hacktron reported an RCE in libheif, an AVIF decoder used by Next.js image optimization. Vercel and Hacktron reproduced the issue, then coordinated with upstream maintainers (sharp, libvips, libheif) to deploy platform-wide mitigations and release fixes across the ecosystem.