NEXT · CVE-2026-119347 · Runtime
FIX → 16.4.5 · 15.5.29
Self-hosted Next.js apps can have the image optimizer at /_next/image process an attacker-supplied SVG even when SVG support is turned off with dangerouslyAllowSVG set to false. This reaches an SVG parser the application meant to keep disabled, which raises the risk of denial of service and SVG decoder flaws.
first public Nov 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted Next.js deployments that use the built-in image optimizer at /_next/image are exposed, even when SVG support is disabled in the config. Apps on managed hosting, or apps that do not serve images through the optimizer, are not described as affected by the sources.
Not affected if managed-hosting
Who cares next.js, self-hosted
npm ls next; affected are 16.0.0 through 16.4.4 and 15.0.0 through 15.5.28.dangerouslyAllowSVG in next.config.js or ; the flaw matters when the app serves on a self-hosted server.On self-hosted deployments, the Next.js image optimizer (/_next/image) can be made to process an attacker-supplied SVG even when SVG support is disabled with dangerouslyAllowSVG: false (the default). This reaches an SVG parser the application intended to keep disabled, increasing exposure to denial of service and SVG decoder vulnerabilities.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
next.config.mjs/_next/imageUpgrade to 16.4.5 · 15.5.29
16.x: move to 16.4.515.x: move to 15.5.29