{"id":"GHSA-2464-fhr4-w9xw","title":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used","summary":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used","severity":"critical","cwe":["CWE-1395"],"vendor":"next","product":"next","ecosystem":"npm","affected":["next >= 10.0.0, <= 15.5.27","next >= 16.0.0, <= 16.4.0"],"patched":["next 15.5.28","next 16.4.1"],"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T15:52:56Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-2464-fhr4-w9xw","references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96889"},{"url":"https://github.com/vercel/next.js/commit/5e3b687b5edb868b064bdc058d768a7021e7f6ad"},{"url":"https://github.com/vercel/next.js/commit/9571ec899f063df6533351bec390ccb2cc0af6a3"},{"url":"https://github.com/vercel/next.js/releases/tag/v15.5.28"},{"url":"https://github.com/vercel/next.js/releases/tag/v16.4.1"},{"url":"https://github.com/advisories/GHSA-2464-fhr4-w9xw"}],"tags":["ghsa","npm"],"ingestedAt":"2026-10-22T22:00:50.260Z","slug":"GHSA-2464-fhr4-w9xw","body":"## Overview\n\n## Impact\n\nA memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.\n\n## Workaround\n\nEnsure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`.\nUpgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.\n\n## Affected packages\n\n- `next >= 10.0.0, <= 15.5.27`\n- `next >= 16.0.0, <= 16.4.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `next 15.5.28`\n- `next 16.4.1`","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}