Repository advisory GHSA-2xp9-vwfh-vxw4 (Next.js, Critical 9.5, published 2026-08-25) not ingested into the Advisory Database

Start by reviewing the repository's contribution guidance, then verify the advisory details and lookup results listed in the issue for GHSA-2xp9-vwfh-vxw4. No source file, test, or ingestion entry point is identified, so the first task is locating the review and import workflow. Done means the advisory is present in the global database and the requested review-latency or pending-advisory behavior is clarified.

Summary

A Critical repository-level security advisory published on vercel/next.js
on 2026-08-25 is still absent from the global GitHub Advisory Database as of
2026-09-03, nine days later. Because every downstream consumer keys off that
database, the vulnerability is currently invisible to Dependabot, npm audit,
yarn audit, osv-scanner and anything else built on the OSV mirror.

Advisory

• GHSA ID: GHSA-2xp9-vwfh-vxw4
• Title: Unauthenticated Remote Code Execution in Image Optimization API when
  AVIF files are used
• Package: npm next
• Affected: >= 10.0.0 < 15.5.24 and < 16.3.3
• Patched: 15.5.24, 16.3.3
• Severity: Critical, CVSS v4 9.5
  (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
• CVE: none assigned
• Upstream reference: GHSA-g89c-p67h-r497 (strukturag/libheif)

Current state

Expected behaviour

A published repository advisory in a supported ecosystem (npm) should be
reviewed and ingested into the global Advisory Database, and from there
propagate to the API, the OSV mirror and Dependabot alerts.

Impact

Any team whose vulnerability management relies on the documented tooling —
which is the tooling GitHub itself recommends — got a clean bill of health
for a Critical unauthenticated RCE affecting two major release branches of
one of the most widely deployed npm packages. Verifying it required manually
opening the vendor's own advisory page, which does not scale and is not a
process any automated pipeline can perform.

Requests

1. Ingest GHSA-2xp9-vwfh-vxw4 into the Advisory Database.
2. Clarify the expected review latency for repository advisories, and whether
   Critical-severity submissions are prioritised.
3. Consider exposing an API surface for published-but-not-yet-curated
   repository advisories, so scanners can at least flag them as pending
   rather than reporting zero findings.