---
title: "GHSA-2464-fhr4-w9xw: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used"
url: https://erroneo.us/security/ghsa/GHSA-2464-fhr4-w9xw/
description: "GHSA-2464-fhr4-w9xw (critical, npm): Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used. Impact A…"
type: advisory
section: "Security Digest"
date_published: 2026-10-22
date_modified: 2026-10-22
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-2464-fhr4-w9xw"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-2464-fhr4-w9xw: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

## Affected packages

- npm `next` >= 10.0.0, <= 15.5.27 → fixed: 15.5.28
- npm `next` >= 16.0.0, <= 16.4.0 → fixed: 16.4.1

## Details

Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.

## Sources

- [GitHub Advisory GHSA-2464-fhr4-w9xw](https://github.com/advisories/GHSA-2464-fhr4-w9xw)
- [github.com](https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw)
- [nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-96889)
- [github.com](https://github.com/vercel/next.js/commit/5e3b687b5edb868b064bdc058d768a7021e7f6ad)
- [github.com](https://github.com/vercel/next.js/commit/9571ec899f063df6533351bec390ccb2cc0af6a3)
- [github.com](https://github.com/vercel/next.js/releases/tag/v15.5.28)
- [github.com](https://github.com/vercel/next.js/releases/tag/v16.4.1)

---
Source page: https://erroneo.us/security/ghsa/GHSA-2464-fhr4-w9xw/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt