Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

next (npm)

## Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. ## Workaround Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of…

First seen: 22 Oct 2026
Last update: 22 Oct 2026, 15:52 UTC
Fixed in: next 15.5.28
next 16.4.1
Source: GitHub advisory
On the menu as: npm packages
Next.js

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
Severity: critical. Patch status: patched.
Affected: next (npm)
Fixed in: next 15.5.28, next 16.4.1

## Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. ## Workaround Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of…

## Steps
1. Search every lockfile and manifest (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements*.txt, poetry.lock, uv.lock, composer.lock, go.sum, Cargo.lock, Gemfile.lock) for `next`. For each hit, compare the installed version with the fix on the same major line: next 15.5.28, next 16.4.1. If it's lower, give the exact upgrade command for the package manager this repo uses.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/advisories/GHSA-2464-fhr4-w9xw https://github.com/vercel/next.js/commit/5e3b687b5edb868b064bdc058d768a7021e7f6ad https://github.com/vercel/next.js/commit/9571ec899f063df6533351bec390ccb2cc0af6a3 https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw https://nvd.nist.gov/vuln/detail/CVE-2026-96889
https://pwned.coffee/i/next-js-unauthenticated-remote-code-execution-in-image-optimization-api

Sources

Totalone very hot coffee