GHSA-2464-fhr4-w9xw

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

Published

2026-10-22

Modified

2026-10-22

Sources

github-advisory

Summary

## Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. ## Workaround Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.

Affected packages

Remediation: Upgrade to 15.5.28 or later.

References

• https://github.com/advisories/GHSA-2464-fhr4-w9xw