Disable AVIF input optimization when sharp bundles a vulnerable libheif

Author: eps1lon

packages/next/src/server/image-optimizer.ts

@@ -112,6 +112,47 @@ export function getSharp(concurrency: number | null | undefined) {
   return _sharp
 }
 
+// libheif before 1.23.2 has critical memory safety vulnerabilities in AVIF
+// decoding (GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545). sharp only bundles
+// a patched libheif starting with 0.35.4, and Node 18 installs always resolve
+// the vulnerable 0.34 line, so the decoder version is checked at runtime
+// instead of relying on the sharp version.
+// Exported for test integration only.
+export function isAvifDecodeSafe(heifVersion: string | null): boolean {
+  if (heifVersion === null) {
+    return false
+  }
+  const [major = Number.NaN, minor = Number.NaN, patch = Number.NaN] =
+    heifVersion.split('.').map((part) => Number.parseInt(part, 10))
+  if (Number.isNaN(major) || Number.isNaN(minor) || Number.isNaN(patch)) {
+    return false
+  }
+  return (
+    major > 1 ||
+    (major === 1 && minor > 23) ||
+    (major === 1 && minor === 23 && patch >= 2)
+  )
+}
+
+let _avifDecodeSafe: boolean | null = null
+
+function canDecodeAvif(concurrency: number | null | undefined): boolean {
+  if (_avifDecodeSafe === null) {
+    let heifVersion: string | null = null
+    try {
+      // Custom libvips builds do not report dependency versions, so the
+      // absence of a heif version is treated as unsafe.
+      heifVersion = getSharp(concurrency).versions?.heif ?? null
+    } catch {
+      // Without sharp no AVIF can be decoded either, so treat it as unsafe
+      // and let the image pass through unoptimized.
+      heifVersion = null
+    }
+    _avifDecodeSafe = isAvifDecodeSafe(heifVersion)
+  }
+  return _avifDecodeSafe
+}
+
 export interface ImageParamsResult {
   href: string
   isAbsolute: boolean
@@ -982,7 +1023,11 @@ export async function imageOptimizer(
       upstreamEtag,
     }
   }
-  if (BYPASS_TYPES.includes(upstreamType)) {
+  if (
+    BYPASS_TYPES.includes(upstreamType) ||
+    (upstreamType === AVIF &&
+      !canDecodeAvif(nextConfig.experimental.imgOptConcurrency))
+  ) {
     return {
       buffer: upstreamBuffer,
       contentType: upstreamType,

test/e2e/image-optimizer/app/pages/index.tsx

@@ -0,0 +1,3 @@
+export default function Page() {
+  return <p>hello world</p>
+}

test/e2e/image-optimizer/app/public/test.avif

@@ -0,0 +1,66 @@
+import fs from 'fs-extra'
+import { join } from 'path'
+import { nextTestSetup } from 'e2e-utils'
+
+const appDir = join(__dirname, 'app')
+
+describe.each([
+  // sharp 0.34.5 bundles libheif 1.20.2, which is affected by the AVIF
+  // decoding vulnerabilities fixed in libheif 1.23.2.
+  {
+    sharp: '0.34.5',
+    decodesAvif: false,
+  },
+  // sharp 0.35.4 is the first release bundling the patched libheif 1.23.2.
+  {
+    sharp: '0.35.4',
+    decodesAvif: true,
+  },
+])('with sharp $sharp', ({ sharp, decodesAvif }) => {
+  const patchedSharpDeps = {
+    sharp,
+    '@img/sharp-darwin-arm64': sharp,
+    '@img/sharp-darwin-x64': sharp,
+    '@img/sharp-linux-arm64': sharp,
+    '@img/sharp-linux-x64': sharp,
+    '@img/sharp-win32-x64': sharp,
+  }
+  const { next } = nextTestSetup({
+    files: appDir,
+    dependencies: patchedSharpDeps,
+  })
+
+  it('only optimizes avif input when the bundled libheif is patched', async () => {
+    const query = new URLSearchParams({
+      url: '/test.avif',
+      w: '256',
+      q: '75',
+    })
+    const res = await next.fetch(`/_next/image?${query}`, {
+      headers: { accept: 'image/webp' },
+    })
+
+    expect(res.status).toBe(200)
+    if (decodesAvif) {
+      expect(res.headers.get('content-type')).toBe('image/webp')
+    } else {
+      expect(res.headers.get('content-type')).toBe('image/avif')
+      const source = await fs.readFile(join(appDir, 'public/test.avif'))
+      expect(Buffer.from(await res.arrayBuffer()).equals(source)).toBe(true)
+    }
+  })
+
+  it('still optimizes other formats', async () => {
+    const query = new URLSearchParams({
+      url: '/test.png',
+      w: '256',
+      q: '75',
+    })
+    const res = await next.fetch(`/_next/image?${query}`, {
+      headers: { accept: 'image/webp' },
+    })
+
+    expect(res.status).toBe(200)
+    expect(res.headers.get('content-type')).toBe('image/webp')
+  })
+})

test/e2e/image-optimizer/app/public/test.png

@@ -16,6 +16,7 @@ import {
   waitFor,
 } from 'next-test-utils'
 import isAnimated from 'next/dist/compiled/is-animated'
+import { getSharp, isAvifDecodeSafe } from 'next/dist/server/image-optimizer'
 import type { RequestInit } from 'node-fetch'
 import type { NextConfig } from 'next'
 
@@ -100,6 +101,26 @@ export async function expectWidth(res, w, { expectAnimated = false } = {}) {
   expect(isAnimated(buffer)).toBe(expectAnimated)
 }
 
+async function expectUnoptimizedImage(res, filename: string) {
+  const buffer = Buffer.from(await res.arrayBuffer())
+  const source = await fs.readFile(join(__dirname, '../app/public', filename))
+  expect(buffer).toEqual(source)
+  expect(res.headers.get('Content-Length')).toBe(
+    Buffer.byteLength(source).toString()
+  )
+}
+
+// The image optimizer only decodes AVIF input when the installed sharp
+// bundles a patched libheif. The same check decides the expectations here so
+// CI jobs pinned to the vulnerable 0.34 line (Node 18) assert the bypass.
+function isAvifInputOptimizable(): boolean {
+  try {
+    return isAvifDecodeSafe(getSharp(null).versions?.heif ?? null)
+  } catch {
+    return false
+  }
+}
+
 export const cleanImagesDir = async (ctx: { imagesDir: string }) => {
   console.warn('Cleaning', ctx.imagesDir)
   await fs.remove(ctx.imagesDir)
@@ -530,16 +551,24 @@ export function runTests(ctx: RunTestsCtx) {
     const opts = { headers: { accept } }
     const res = await fetchViaHTTP(ctx.appPort, '/_next/image', query, opts)
     expect(res.status).toBe(200)
-    expect(res.headers.get('Content-Type')).toContain('image/jpeg')
     expect(res.headers.get('Cache-Control')).toBe(
       `public, max-age=${isDev ? 0 : minimumCacheTTL}, must-revalidate`
     )
     expect(res.headers.get('Vary')).toBe('Accept')
     expect(res.headers.get('etag')).toBeTruthy()
-    expect(res.headers.get('Content-Disposition')).toBe(
-      `${contentDispositionType}; filename="test.jpeg"`
-    )
-    await expectWidth(res, ctx.w)
+    if (isAvifInputOptimizable()) {
+      expect(res.headers.get('Content-Type')).toContain('image/jpeg')
+      expect(res.headers.get('Content-Disposition')).toBe(
+        `${contentDispositionType}; filename="test.jpeg"`
+      )
+      await expectWidth(res, ctx.w)
+    } else {
+      expect(res.headers.get('Content-Type')).toContain('image/avif')
+      expect(res.headers.get('Content-Disposition')).toBe(
+        `${contentDispositionType}; filename="test.avif"`
+      )
+      await expectUnoptimizedImage(res, 'test.avif')
+    }
   })
 
   it('should fail when url is missing', async () => {
@@ -810,16 +839,24 @@ export function runTests(ctx: RunTestsCtx) {
     const opts = { headers: { accept: 'image/webp' } }
     const res = await fetchViaHTTP(ctx.appPort, '/_next/image', query, opts)
     expect(res.status).toBe(200)
-    expect(res.headers.get('Content-Type')).toBe('image/webp')
     expect(res.headers.get('Cache-Control')).toBe(
       `public, max-age=${isDev ? 0 : minimumCacheTTL}, must-revalidate`
     )
     expect(res.headers.get('Vary')).toBe('Accept')
     expect(res.headers.get('etag')).toBeTruthy()
-    expect(res.headers.get('Content-Disposition')).toBe(
-      `${contentDispositionType}; filename="test.webp"`
-    )
-    await expectWidth(res, ctx.w)
+    if (isAvifInputOptimizable()) {
+      expect(res.headers.get('Content-Type')).toBe('image/webp')
+      expect(res.headers.get('Content-Disposition')).toBe(
+        `${contentDispositionType}; filename="test.webp"`
+      )
+      await expectWidth(res, ctx.w)
+    } else {
+      expect(res.headers.get('Content-Type')).toBe('image/avif')
+      expect(res.headers.get('Content-Disposition')).toBe(
+        `${contentDispositionType}; filename="test.avif"`
+      )
+      await expectUnoptimizedImage(res, 'test.avif')
+    }
   })
 
   it('should resize relative url and old Chrome accept header as webp', async () => {
@@ -877,7 +914,11 @@ export function runTests(ctx: RunTestsCtx) {
       expect(res.headers.get('Content-Disposition')).toBe(
         `${contentDispositionType}; filename="test.avif"`
       )
-      await expectWidth(res, ctx.w)
+      if (isAvifInputOptimizable()) {
+        await expectWidth(res, ctx.w)
+      } else {
+        await expectUnoptimizedImage(res, 'test.avif')
+      }
     })
 
     it('should compress avif smaller than webp at q=100', async () => {