{"id":"GHSA-2464-fhr4-w9xw","aliases":[],"url":"https://o3.security/vulnerability/GHSA-2464-fhr4-w9xw","summary":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used","details":"## Impact\n\nA memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.\n\n## Workaround\n\nEnsure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`.\nUpgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.","published":"2026-10-22T15:52:53Z","modified":"2026-10-22T16:00:09.125335909Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"next","fixedVersion":"15.5.28"},{"ecosystem":"npm","name":"next","fixedVersion":"16.4.1"}],"fix":{"url":"https://github.com/vercel/next.js/commit/5e3b687b5edb868b064bdc058d768a7021e7f6ad","label":"vercel/next.js@5e3b687"},"references":[{"type":"WEB","url":"https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96889"},{"type":"WEB","url":"https://github.com/vercel/next.js/commit/5e3b687b5edb868b064bdc058d768a7021e7f6ad"},{"type":"WEB","url":"https://github.com/vercel/next.js/commit/9571ec899f063df6533351bec390ccb2cc0af6a3"},{"type":"PACKAGE","url":"https://github.com/vercel/next.js"},{"type":"WEB","url":"https://github.com/vercel/next.js/releases/tag/v15.5.28"},{"type":"WEB","url":"https://github.com/vercel/next.js/releases/tag/v16.4.1"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-22T16:00:09.125335909Z"}}