{"id":"GHSA-2464-fhr4-w9xw","revision":"5836a307e8524869b53785328cbaa8d3","records":[{"revision":"5836a307e8524869b53785328cbaa8d3","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-2464-fhr4-w9xw","aliases":[],"title":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used","description":"## Impact\n\nA memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.\n\n## Workaround\n\nEnsure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`.\nUpgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.","state":0,"publishedAt":"2026-10-22T15:52:53+00:00","modifiedAt":"2026-10-22T16:00:09.1253359+00:00","affected":[{"ecosystem":"npm","name":"next","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.0.0"},{"kind":"fixed","version":"15.5.28"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"next","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"16.0.0"},{"kind":"fixed","version":"16.4.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw","https://nvd.nist.gov/vuln/detail/CVE-2026-96889","https://github.com/vercel/next.js/commit/5e3b687b5edb868b064bdc058d768a7021e7f6ad","https://github.com/vercel/next.js/commit/9571ec899f063df6533351bec390ccb2cc0af6a3","https://github.com/vercel/next.js","https://github.com/vercel/next.js/releases/tag/v15.5.28","https://github.com/vercel/next.js/releases/tag/v16.4.1"],"sourceUrl":"https://github.com/advisories/GHSA-2464-fhr4-w9xw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2464-fhr4-w9xw","identifiers":["GHSA-2464-fhr4-w9xw"]},"retained":false,"historicalAffected":[]}],"coverage":[]}