Repository advisory GHSA-2xp9-vwfh-vxw4 (Next.js, Critical 9.5, published 2026-08-25) not ingested into the Advisory Database

まずリポジトリのコントリビューションガイダンスを確認し、次に GHSA-2xp9-vwfh-vxw4 について issue に記載されている advisory の詳細と検索結果を検証します。ソースファイル、テスト、または ingestion のエントリポイントは特定されていないため、最初の作業はレビューおよびインポートのワークフローを見つけることです。完了の条件は、advisory がグローバルデータベースに存在し、要求されているレビュー遅延または保留中の advisory の挙動が明確になっていることです。

Summary

A Critical repository-level security advisory published on vercel/next.js
on 2026-08-25 is still absent from the global GitHub Advisory Database as of
2026-09-03, nine days later. Because every downstream consumer keys off that
database, the vulnerability is currently invisible to Dependabot, npm audit,
yarn audit, osv-scanner and anything else built on the OSV mirror.

Advisory

• GHSA ID: GHSA-2xp9-vwfh-vxw4
• Title: Unauthenticated Remote Code Execution in Image Optimization API when
  AVIF files are used
• Package: npm next
• Affected: >= 10.0.0 < 15.5.24 and < 16.3.3
• Patched: 15.5.24, 16.3.3
• Severity: Critical, CVSS v4 9.5
  (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
• CVE: none assigned
• Upstream reference: GHSA-g89c-p67h-r497 (strukturag/libheif)

Current state

Expected behaviour

A published repository advisory in a supported ecosystem (npm) should be
reviewed and ingested into the global Advisory Database, and from there
propagate to the API, the OSV mirror and Dependabot alerts.

Impact

Any team whose vulnerability management relies on the documented tooling —
which is the tooling GitHub itself recommends — got a clean bill of health
for a Critical unauthenticated RCE affecting two major release branches of
one of the most widely deployed npm packages. Verifying it required manually
opening the vendor's own advisory page, which does not scale and is not a
process any automated pipeline can perform.

Requests

1. Ingest GHSA-2xp9-vwfh-vxw4 into the Advisory Database.
2. Clarify the expected review latency for repository advisories, and whether
   Critical-severity submissions are prioritised.
3. Consider exposing an API surface for published-but-not-yet-curated
   repository advisories, so scanners can at least flag them as pending
   rather than reporting zero findings.