Repository advisory GHSA-2xp9-vwfh-vxw4 (Next.js, Critical 9.5, published 2026-08-25) not ingested into the Advisory Database

Bắt đầu bằng việc xem hướng dẫn đóng góp của repository, sau đó xác minh các chi tiết advisory và kết quả tra cứu được liệt kê trong issue cho GHSA-2xp9-vwfh-vxw4. Không xác định được tệp nguồn, bài kiểm thử hoặc điểm vào ingestion nào, vì vậy nhiệm vụ đầu tiên là tìm workflow review và import. Được coi là hoàn thành khi advisory có mặt trong cơ sở dữ liệu toàn cục và hành vi được yêu cầu liên quan đến độ trễ review hoặc advisory đang chờ được làm rõ.

Summary

A Critical repository-level security advisory published on vercel/next.js
on 2026-08-25 is still absent from the global GitHub Advisory Database as of
2026-09-03, nine days later. Because every downstream consumer keys off that
database, the vulnerability is currently invisible to Dependabot, npm audit,
yarn audit, osv-scanner and anything else built on the OSV mirror.

Advisory

• GHSA ID: GHSA-2xp9-vwfh-vxw4
• Title: Unauthenticated Remote Code Execution in Image Optimization API when
  AVIF files are used
• Package: npm next
• Affected: >= 10.0.0 < 15.5.24 and < 16.3.3
• Patched: 15.5.24, 16.3.3
• Severity: Critical, CVSS v4 9.5
  (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
• CVE: none assigned
• Upstream reference: GHSA-g89c-p67h-r497 (strukturag/libheif)

Current state

Expected behaviour

A published repository advisory in a supported ecosystem (npm) should be
reviewed and ingested into the global Advisory Database, and from there
propagate to the API, the OSV mirror and Dependabot alerts.

Impact

Any team whose vulnerability management relies on the documented tooling —
which is the tooling GitHub itself recommends — got a clean bill of health
for a Critical unauthenticated RCE affecting two major release branches of
one of the most widely deployed npm packages. Verifying it required manually
opening the vendor's own advisory page, which does not scale and is not a
process any automated pipeline can perform.

Requests

1. Ingest GHSA-2xp9-vwfh-vxw4 into the Advisory Database.
2. Clarify the expected review latency for repository advisories, and whether
   Critical-severity submissions are prioritised.
3. Consider exposing an API surface for published-but-not-yet-curated
   repository advisories, so scanners can at least flag them as pending
   rather than reporting zero findings.