---
id: "CVE-2026-119347"
page: "https://infrastack.ai/live/CVE-2026-119347"
kind: "vulnerability"
aliases: ["CVE-2026-119347", "GHSA-7qx7-33qx-rqx2"]
title: "SVG rejection bypass in Next.js image optimization"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "next", "fixed": ["16.4.5"], "affected": ">= 16.0.0, <= 16.4.4", "ecosystem": "npm"}, {"name": "next", "fixed": ["15.5.29"], "affected": ">= 15.0.0, <= 15.5.28", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["next.js", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-11-03T18:39:51+00:00"
first_seen_at: "2026-11-09T22:53:14+00:00"
updated_at: "2026-11-09T22:54:33+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/vercel/next.js/security/advisories/GHSA-7qx7-33qx-rqx2", "first_seen_at": "2026-11-09T22:53:14+00:00"}]
exploit_sources: []
---

# SVG rejection bypass in Next.js image optimization

Link for people: https://infrastack.ai/live/CVE-2026-119347 (this .md is for agents)

Self-hosted Next.js apps can have the image optimizer at /_next/image process an attacker-supplied SVG even when SVG support is turned off with dangerouslyAllowSVG set to false. This reaches an SVG parser the application meant to keep disabled, which raises the risk of denial of service and SVG decoder flaws.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:next affected >= 16.0.0, <= 16.4.4 fixed 16.4.5
- npm:next affected >= 15.0.0, <= 15.5.28 fixed 15.5.29

## How to check

- Check the installed version with `npm ls next`; affected are `16.0.0` through `16.4.4` and `15.0.0` through `15.5.28`.
- Look for `dangerouslyAllowSVG` in `next.config.js` or `next.config.mjs`; the flaw matters when the app serves `/_next/image` on a self-hosted server.
- Check whether the deployment is self-hosted rather than on a managed host.

## Fix

- next `16.x`: move to `16.4.5`
- next `15.x`: move to `15.5.29`

## Timeline

- 2026-11-09T22:53:14+00:00 ghsa-repo https://github.com/vercel/next.js/security/advisories/GHSA-7qx7-33qx-rqx2

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/vercel/next.js/security/advisories/GHSA-7qx7-33qx-rqx2

## From the sources

<!-- https://linear.app/vercel/issue/NSEC-438 -->
On self-hosted deployments, the Next.js image optimizer (`/_next/image`) can be made to process an attacker-supplied SVG even when SVG support is disabled with `dangerouslyAllowSVG: false` (the default). This reaches an SVG parser the application intended to keep disabled, increasing exposure to denial of service and SVG decoder vulnerabilities.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_