GitHub Advisoryadvisory · npm

GHSA-2464-fhr4-w9xw Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

CRITICAL Published 2026-10-22 Modified 2026-10-22 Official page ↗
Ecosystem
npm
Packages
next
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weaknesses
CWE-1395
Reviewed
2026-10-22

Affected packages

• npm next: >= 10.0.0, < 15.5.28 → fixed in 15.5.28 • npm next: >= 16.0.0, < 16.4.1 → fixed in 16.4.1

Description

Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. Workaround Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.

Related

Weakness · CWE (1)

  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness

References