---
id: GHSA-2464-fhr4-w9xw
title: >-
  Next.js: Unauthenticated Remote Code Execution in Image Optimization API when
  SVG files are used
summary: >-
  Next.js: Unauthenticated Remote Code Execution in Image Optimization API when
  SVG files are used
severity: critical
cwe:
  - CWE-1395
vendor: next
product: next
ecosystem: npm
affected:
  - 'next >= 10.0.0, <= 15.5.27'
  - 'next >= 16.0.0, <= 16.4.0'
patched:
  - next 15.5.28
  - next 16.4.1
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T15:52:56Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-2464-fhr4-w9xw'
references:
  - url: 'https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-96889'
  - url: >-
      https://github.com/vercel/next.js/commit/5e3b687b5edb868b064bdc058d768a7021e7f6ad
  - url: >-
      https://github.com/vercel/next.js/commit/9571ec899f063df6533351bec390ccb2cc0af6a3
  - url: 'https://github.com/vercel/next.js/releases/tag/v15.5.28'
  - url: 'https://github.com/vercel/next.js/releases/tag/v16.4.1'
  - url: 'https://github.com/advisories/GHSA-2464-fhr4-w9xw'
tags:
  - ghsa
  - npm
ingestedAt: '2026-10-22T22:00:50.260Z'
---

## Overview

## Impact

A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.

## Workaround

Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`.
Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.

## Affected packages

- `next >= 10.0.0, <= 15.5.27`
- `next >= 16.0.0, <= 16.4.0`

## Remediation

Upgrade to a patched release:

- `next 15.5.28`
- `next 16.4.1`