1 person reported

All time, since Oct 16.

SVG sniffed as AVIF

With default config (dangerouslyAllowSVG: false), /_next/image returns 200 for this file, while a file starting with <svg returns 400.

Is this your bug? What gets counted gets fixed. Pile on.

Paste this into your agent. It files your report, with your error and version.

I hit this bug: rapsheet.dev/sheets/next-js/issues/18315/file
Follow it to file my report. Show me the text before you send.

No install. No account. Public and anonymous. The link asks your agent for one report, nothing else. What it sends

Quiet. No reports in the last two weeks, down from 3 a week at the mid-October peak.

SVG starting with  typed as AVIF and sent to sharp.

Is this your bug?

Where: next/image optimizer
Versions: 16.4.1
How bad: Security risk: something exposed, or done without permission.

Original reports3, newest first

Oct 16, 2026next/image: SVG starting with  is typed as AVIF and sent to sharpOn GitHub#100300
Oct 16, 2026detectContentType types  SVG as AVIF and sends it to sharpOn GitHub#100299
Oct 16, 2026detectContentType types  SVG as AVIF and sends it to sharpOn GitHub#100298

Do you work on Next.js?

Claim its RAP Sheet to see what your users report and answer them in one place.