A critical advisory for Next.js describes unauthenticated remote code execution (RCE) in the Image Optimization API when SVG files are used. According to the GitHub advisory, the root cause is a memory-related vulnerability in an upstream library used for image optimization, and it can lead to possible code execution when Next.js runs on glibc-based Linux.
If you run a self-hosted Next.js application, or manage hosting for clients who do, you should check your version and your sharp dependency now. The advisory was published on October 14, 2026 and last updated on October 22, 2026.
What the advisory says
The advisory is titled "Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used" and is rated Critical, with a CVSS v4 score of 9.5. It references CVE-2026-96889 on NVD. The advisory states the impact in one sentence: a memory-related flaw in an upstream library used for Image Optimization can lead to possible remote code execution on glibc-based Linux.
The advisory text we have does not name the upstream library's specific bug, and it does not say whether the flaw is being exploited in the wild. Treat exploitation status as unconfirmed. At the time of writing, only this one primary source covers the story, so details may be refined as more analysis appears.
Affected and fixed versions
| Release range | Affected | Patched |
|---|---|---|
| 10.0.0 through 15.x | >= 10.0.0, <= 15.5.27 | 15.5.28 |
| 16.x | >= 16.0.0, <= 16.4.0 | 16.4.1 |
The advisory also offers a workaround: make sure the version of sharp used by Next.js is 0.35.5 or newer. It notes that fresh installs automatically receive a fixed sharp version, and that upgrading Next.js to a patched release makes package managers provide a fixed sharp to Next.js. The advisory does not name the vulnerable upstream library directly; the sharp workaround is the only pointer to where the problem lies.
Why this class of bug matters
This section is general background on memory-safety bugs, not a description of the specific flaw, which the advisory does not detail. Image optimization features typically accept an image, decode it and resize or convert it using native, compiled code. When compiled code mishandles memory while parsing a file, the server process can end up with corrupted memory, and in the worst case an attacker can turn that into running their own code.
What the advisory does tell us is how the CVSS v4 metrics rate this issue: Attack Vector is Network, Privileges Required is None and User Interaction is None. In plain terms, a remote party would not need an account or any action from a user. The metrics also list Attack Requirements as Present. The advisory does not spell out what those requirements are beyond the conditions in its title and impact statement (SVG files in use, glibc-based Linux), so do not assume you are safe just because you do not knowingly serve SVGs. Verify instead.
Who is realistically exposed
- Self-hosted Next.js apps running on glibc-based Linux that use the built-in Image Optimization API. Check whether your base image or server uses glibc rather than another C library.
- Existing installs and already-built containers. The advisory says fresh installs get a fixed sharp, so anything installed earlier should be verified rather than assumed fixed.
- Agencies and hosts that run many Next.js sites and may have a mix of versions across the 10 to 15 and 16 lines.
The advisory does not say how platforms that host Next.js for you are affected. If you deploy to a managed platform, check that provider's notices and confirm which Next.js version your build actually uses.
How to check your exposure
- Find your Next.js version: run npm ls next (or the yarn or pnpm equivalent) in the project, and check the lockfile for the resolved version.
- Compare it with the table above. Anything at or below 15.5.27 (from 10.0.0), or from 16.0.0 up to 16.4.0, is affected.
- Find your sharp version with npm ls sharp. The workaround threshold is 0.35.5 or newer.
- Confirm the runtime: check whether your container or server uses a glibc-based Linux distribution, since the advisory scopes the risk to that.
- Review whether your app exposes the image optimization route publicly and whether it processes SVG files, for example through remote image patterns or uploaded content.
- Check every environment, not just production: staging, preview builds and old containers still running.
What to do now
- Upgrade Next.js to 15.5.28 if you are on a version up to 15.x, or 16.4.1 if you are on the 16 line. The upgrade lets your package manager supply a fixed sharp.
- If you cannot upgrade immediately, make sure sharp resolves to 0.35.5 or newer, as the advisory's workaround describes, then reinstall and verify with npm ls sharp.
- Rebuild and redeploy images and containers, so the fixed dependency is actually in the running artifact.
- Restrict which remote image sources your app will optimize, and avoid optimizing untrusted SVG content where you can. This is general hardening and not a substitute for patching.
- Run the Node.js process as a non-root user with minimal filesystem and network permissions, to limit the damage if a process is ever compromised.
Detection and monitoring afterwards
Because the flaw sits in a request-handling path, review web server and application logs for unusual traffic to the image optimization route, repeated crashes or restarts of the Node.js process, and unexpected child processes or outbound connections from your app servers. None of these is a confirmed indicator for this issue, since the advisory does not publish any. They are general signs worth investigating on any server that might have been hit.
A web application firewall can add a layer of filtering in front of your app, but it is not a replacement for the upgrade; see what a WAF is for what it can and cannot do. You can also use Webforta Scan to review the public-facing side of a site you own. If you suspect a compromise, follow our guide on what to do when a website is hacked and rotate any secrets the server could read. For more security news, browse the Webforta blog.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.
- GHSA-2464-fhr4-w9xw - GitHub Advisory Database (github.com, )
Tags: Next.js, RCE, Image Optimization, sharp, npm, Node.js