Beyond the Pixel: Dissecting the Attack Surface of Shared Native Image Pipelines in Modern Web Frameworks
Using CVE-2026-84383 as a case study, this article dissects the shared Sharp, libvips, and libheif native image pipeline in Next.js, Nuxt, and Astro, and explains how low-level memory corruption becomes remotely reachable from the Web.