Next.js image optimization can run code from a crafted SVG
On October 14, 2026, Next.js published GHSA-2464-fhr4-w9xw, which it also labels CVE-2026-96889. A memory bug in an upstream image library can lead to remote code execution when image optimization handles SVG on glibc-based Linux. Patched releases are next 15.5.28 and 16.4.1.
What was reported
The Next.js advisory published October 14, 2026 says a memory-related vulnerability in an upstream library used for image optimization can lead to remote code execution when Next.js runs on glibc-based Linux and SVG files are used. The advisory labels the issue CVE-2026-96889. This note follows that advisory for the impact on Next.js.
The affected ranges it lists are next 10.0.0 through 15.5.27, and next after 16.0.0 through 16.4.0. The patched releases are 15.5.28 and 16.4.1. The workaround is to use sharp 0.35.5 or later. The advisory says fresh installs get a fixed version of sharp, and that upgrading Next.js to the patched releases makes the package manager supply that version.
The same October 14 post covers two other issues, a use cache remote code execution bug and a Server Actions denial of service. Those have their own items. This one is only the image-optimization SVG bug.
How to prevent it
Upgrade next to 15.5.28 if you are on 10.0.0 through 15.5.27, or to 16.4.1 if you are on a 16.x release after 16.0.0 through 16.4.0. The advisory's workaround is to make sure the sharp version Next.js uses is 0.35.5 or later. It says fresh installs get a fixed sharp, and that upgrading Next.js makes the package manager supply that fixed sharp.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.