Security Digest · Critical advisory (no CVE assigned)
GHSA-2464-fhr4-w9xw: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.
CVSS 9.5 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
npm audit (or: npm ls <package>). - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| npm | next | >= 10.0.0, <= 15.5.27 | 15.5.28 |
| npm | next | >= 16.0.0, <= 16.4.0 | 16.4.1 |
Details
Impact
A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.
Workaround
Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.
CVSS: 9.5 (v4.0) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Sources and references
- GitHub Advisory GHSA-2464-fhr4-w9xw github.com
- github.com github.com
- nvd.nist.gov nvd.nist.gov
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com