nextjs.vnTiếng Việt

All advisories

Remote code execution via Image Optimization when SVG files are used

Critical CVSS 9.5 · Published 2026-10-22 · GHSA-2464-fhr4-w9xw · CVE-2026-96889

Original title: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

What happens

A memory bug in an upstream image library used by Next.js Image Optimization (sharp) can let an unauthenticated attacker run code on the server. It applies when Next.js runs on glibc-based Linux.

Who is affected

  • Next.js running on glibc-based Linux (for example Debian or Ubuntu) that uses the Next.js image optimization API.
  • Per the advisory title, the bug concerns optimizing SVG files.

Affected and fixed versions

AffectedFixed in
>= 10.0.0, <= 15.5.2715.5.28
>= 16.0.0, <= 16.4.016.4.1

What to do

  • Upgrade Next.js to the fixed version in the table below; package managers then pull a fixed sharp.
  • If you cannot upgrade yet: make sure the sharp used by Next.js is 0.35.5 or later. A fresh install gets a fixed version.

Check yourself

  • Run npm ls next sharp (or bun pm ls) and compare against the table below and the sharp 0.35.5 floor.
  • Check the server is glibc Linux: the first line of ldd --version says GNU libc or GLIBC (a musl system says musl).

Sources

Rewritten from the original advisory; versions from the GitHub Advisory Database (CC-BY-4.0), updated 2026-10-29. Where they differ, the original advisory wins.