{"vulnerability": "GHSA-2xp9-vwfh-vxw4", "sightings": [{"uuid": "2af980b1-8073-42ac-8bbf-48cd132c88f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-2XP9-VWFH-VXW4", "type": "published-proof-of-concept", "source": "Telegram/5OcvQ0Kvc7EZmNnx124YGJsJb961fNxRCYGvYNIkiajBUhEy", "content": "", "creation_timestamp": "2026-08-27T00:00:07.112594Z"}, {"uuid": "9623cf78-7aad-432b-9685-90f0104180e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-2xp9-vwfh-vxw4", "type": "seen", "source": "https://bsky.app/profile/newshoundai.bsky.social/post/3mup4ebo6nc2i", "content": "The second vulnerability is a heap overflow in the AVIF image format documented as GHSA-2xp9-vwfh-vxw4 with a CVSS score of 9.5. This issue operates through the libheif library up to version 1.23.1 and affects Next.js versions 10.0.0 through 15.5.23 and the 16.x branch up to 16.3.2. The", "creation_timestamp": "2026-09-04T13:52:33.009902Z"}]}