GHSA-2464-fhr4-w9xwCritical▾ MidnightNext.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.
Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp.
Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.
next >= 10.0.0, <= 15.5.27next >= 16.0.0, <= 16.4.0Upgrade to a patched release:
next 15.5.28next 16.4.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94482High· 8.2Next.js: Denial of Service in App Router using Server Actions
GHSA-673q-mjm6-r5xrCriticalNext.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
GHSA-vcvr-r3jv-pc5jCriticalNext.js: Remote Code Execution in next/og ImageResponse
GHSA-2xp9-vwfh-vxw4CriticalNext.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
CVE-2026-75604Critical· 9.0Next.js is a React framework for building full-stack web applications
CVE-2026-64643MediumNext.js: Unauthenticated disclosure of internal Server Function endpoints