Next.js: Unauthenticated RCE in Image Optimization API via sharp memory vulnerability when SVG files are used (CVE-2026-96889)
Severity: critical · Patch status: patched · Since 2026-10-14 · CVE-2026-96889
A critical (CVSS 9.5) unauthenticated remote code execution vulnerability (CVE-2026-96889) in Next.js was disclosed via GitHub Advisory GHSA-2464-fhr4-w9xw. The flaw stems from a memory-related vulnerability in the upstream sharp image-processing library used by Next.js's Image Optimization API, and is exploitable when SVG files are processed on glibc-based Linux deployments. All Next.js versions from 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0 are affected. No in-the-wild exploitation is known. Fixes shipped in Next.js 15.5.28 and 16.4.1, which ensure package managers provide sharp = 0.35.5; alternatively, operators can directly ensure sharp = 0.35.5 as a workaround.
What to do
- Upgrade Next.js to 15.5.28 or 16.4.1 (or later) and reinstall dependencies so sharp resolves to >= 0.35.5
- If upgrading is not immediately possible, verify and pin sharp >= 0.35.5 in the dependency tree and redeploy
- Audit deployments running on glibc-based Linux with the Image Optimization API exposed, especially where SVG inputs are processed
- Check logs for suspicious requests to the image optimization endpoint and review for signs of exploitation
Fixed versions
- next 15.5.28
- next 16.4.1
- sharp 0.35.5
Sources
All live incidents on Threat Watch
