standard
AVIF is an image format based on AV1 video compression, offering smaller file sizes than JPEG or WebP at higher encoding cost, with support for animation.
No evidence-backed relationships are recorded.
PNG-8 at 124 colors encoded a red-text test poster in 48,481 bytes at an edge error of 0.13 Delta E, smaller and cleaner than every JPEG export. For flat graphics like this one, an export tool that converts everything to JPEG ships bigger files with dirtier red text.
Reality
Headless Chrome 149 wrote the same 1,345,909-byte PNG via canvas.toBlob at quality 0.1 and at 1.0, one developer's measurements show. A PNG export slider only changes the file if the tool downscales, quantises colours or switches to WebP or AVIF.
Reality
The affected releases stretch back to Next.js 13.4, and for Windows self-hosters the only remedy Vercel offers is the version bump. The AVIF bug shipped in the same release at least has a config gate.
Reality
libheif v1.23.5 fixes a high-rated flaw that let a 351-byte AVIF file force decoder allocations of more than 10 GB. It is a drop-in replacement for v1.23.4 and also closes six lower-rated memory-handling bugs.
Reality
The project's own README puts the 2026 advisory count at 37 and the maintenance roster at one independent developer with almost no recurring funding. Products that decode HEIC or AVIF inherit that pace.
Reality
A byte-level walk of a 1.51 MB screen recording puts the untouchable palette tables at under 4 percent of the file. The 38 percent floor has to be explained by redraw rectangles that average 59 percent of the canvas.
Reality
Browsers decode eight image formats and encode three. A dev.to post documents what happens when you ask the canvas API for one of the other five: the success callback fires, and the blob it carries is a PNG.
Reality
No major browser encodes AVIF from a canvas, and the spec says to hand back a PNG without throwing. The only support test that works is reading blob.type on the blob you get back.
Reality
The audit that mattered was a per-URL byte share, and it pointed at one asset instead of the usual list of image, CSS and JavaScript fixes. The result is lab-measured, and the author says his LCP target is still missed.
Reality
The August 2026 release ships 15.5.24 and 16.3.3. One flaw needs a Windows filesystem and has no listed workaround; the other needs only an attacker-supplied AVIF reaching your image optimizer.
Reality
The HTML spec mandates the silent substitution, blob.type is the only record that it happened, and a user-agent lookup table cannot stand in for the check.
Reality
A default flip to AVIF plus the retirement of `domains` turns a routine Next.js upgrade into a production image incident. The fix is boring config, applied before the deploy.
Reality