Repository advisory GHSA-2xp9-vwfh-vxw4 (Next.js, Critical 9.5, published 2026-08-25) not ingested into the Advisory Database

Comienza revisando las directrices de contribución del repositorio y, después, verifica los detalles del advisory y los resultados de consulta indicados en el issue para GHSA-2xp9-vwfh-vxw4. No se identifica ningún archivo fuente, prueba ni punto de entrada de ingestión, por lo que la primera tarea es localizar el flujo de revisión e importación. Se considera completado cuando el advisory está presente en la base de datos global y se ha aclarado el comportamiento solicitado respecto a la latencia de revisión o a los advisories pendientes.

Summary

A Critical repository-level security advisory published on vercel/next.js
on 2026-08-25 is still absent from the global GitHub Advisory Database as of
2026-09-03, nine days later. Because every downstream consumer keys off that
database, the vulnerability is currently invisible to Dependabot, npm audit,
yarn audit, osv-scanner and anything else built on the OSV mirror.

Advisory

• GHSA ID: GHSA-2xp9-vwfh-vxw4
• Title: Unauthenticated Remote Code Execution in Image Optimization API when
  AVIF files are used
• Package: npm next
• Affected: >= 10.0.0 < 15.5.24 and < 16.3.3
• Patched: 15.5.24, 16.3.3
• Severity: Critical, CVSS v4 9.5
  (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
• CVE: none assigned
• Upstream reference: GHSA-g89c-p67h-r497 (strukturag/libheif)

Current state

Expected behaviour

A published repository advisory in a supported ecosystem (npm) should be
reviewed and ingested into the global Advisory Database, and from there
propagate to the API, the OSV mirror and Dependabot alerts.

Impact

Any team whose vulnerability management relies on the documented tooling —
which is the tooling GitHub itself recommends — got a clean bill of health
for a Critical unauthenticated RCE affecting two major release branches of
one of the most widely deployed npm packages. Verifying it required manually
opening the vendor's own advisory page, which does not scale and is not a
process any automated pipeline can perform.

Requests

1. Ingest GHSA-2xp9-vwfh-vxw4 into the Advisory Database.
2. Clarify the expected review latency for repository advisories, and whether
   Critical-severity submissions are prioritised.
3. Consider exposing an API surface for published-but-not-yet-curated
   repository advisories, so scanners can at least flag them as pending
   rather than reporting zero findings.