GHSA-2464-fhr4-w9xw

Summary

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

Severity

critical

CWE

CWE-1395

Published

2026-10-22

Updated

2026-10-22

Advisory details

Impact

A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.

Workaround

Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.

References

• https://github.com/advisories/GHSA-2464-fhr4-w9xw
• https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw
• https://nvd.nist.gov/vuln/detail/CVE-2026-96889
• https://github.com/vercel/next.js/commit/5e3b687b5edb868b064bdc058d768a7021e7f6ad
• https://github.com/vercel/next.js/commit/9571ec899f063df6533351bec390ccb2cc0af6a3
• https://github.com/vercel/next.js/releases/tag/v15.5.28
• https://github.com/vercel/next.js/releases/tag/v16.4.1

Related advisories

• GHSA-vcvr-r3jv-pc5j — critical · npm/next
• GHSA-2xp9-vwfh-vxw4 — critical · npm/next
• GHSA-673q-mjm6-r5xr — critical · npm/next
• CVE-2026-75604 — critical · npm/next
• CVE-2026-94482 — high · npm/next
• CVE-2026-94483 — high · npm/next
• CVE-2026-64649 — high · npm/next
• CVE-2026-64645 — high · npm/next

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity