Live › vulnerability › GHSA-2464-fhr4-w9xw
Go to dashboardNext.js Image Optimization can be made to run attacker-supplied code through a memory bug in an upstream image library (sharp), reachable without authentication when SVG images are processed. The sources describe it as remote code execution on glibc-based Linux.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| next | npm | >= 10.0.0, <= 15.5.27 | 15.5.28 |
| next | npm | >= 16.0.0, <= 16.4.0 | 16.4.1 |
Run npm ls next sharp and confirm next is 15.5.28 or later (or 16.4.1 or later) and sharp is 0.35.5 or later.
Check that the app serves or optimizes SVG images through next/image or /_next/image.
15.5.28 (15.x line) or 16.4.1 (16.x line), or ensure the resolved sharp version is at least 0.35.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.
Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp.
Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.
This page as .md · .json · in your agent: get_signal("GHSA-2464-fhr4-w9xw")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.