Repository advisory GHSA-2xp9-vwfh-vxw4 (Next.js, Critical 9.5, published 2026-08-25) not ingested into the Advisory Database

[escherstair]

Summary

A Critical repository-level security advisory published on vercel/next.js
on 2026-08-25 is still absent from the global GitHub Advisory Database as of
2026-09-03, nine days later. Because every downstream consumer keys off that
database, the vulnerability is currently invisible to Dependabot, npm audit,
yarn audit, osv-scanner and anything else built on the OSV mirror.

Advisory

• GHSA ID: GHSA-2xp9-vwfh-vxw4
• Title: Unauthenticated Remote Code Execution in Image Optimization API when
  AVIF files are used
• Package: npm next
• Affected: >= 10.0.0 < 15.5.24 and < 16.3.3
• Patched: 15.5.24, 16.3.3
• Severity: Critical, CVSS v4 9.5
  (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
• CVE: none assigned
• Upstream reference: GHSA-g89c-p67h-r497 (strukturag/libheif)

Current state

Lookup	Result
github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4	200, Critical, ranges as above
github.com/advisories/GHSA-2xp9-vwfh-vxw4	404
api.github.com/advisories?affects=next@16.3.0	advisory not returned
api.osv.dev/v1/vulns/GHSA-2xp9-vwfh-vxw4	404

Expected behaviour

A published repository advisory in a supported ecosystem (npm) should be
reviewed and ingested into the global Advisory Database, and from there
propagate to the API, the OSV mirror and Dependabot alerts.

Impact

Any team whose vulnerability management relies on the documented tooling —
which is the tooling GitHub itself recommends — got a clean bill of health
for a Critical unauthenticated RCE affecting two major release branches of
one of the most widely deployed npm packages. Verifying it required manually
opening the vendor's own advisory page, which does not scale and is not a
process any automated pipeline can perform.

Requests

1. Ingest GHSA-2xp9-vwfh-vxw4 into the Advisory Database.
2. Clarify the expected review latency for repository advisories, and whether
   Critical-severity submissions are prioritised.
3. Consider exposing an API surface for published-but-not-yet-curated
   repository advisories, so scanners can at least flag them as pending
   rather than reporting zero findings.