{"id":"GHSA-2464-fhr4-w9xw","kind":"vulnerability","aliases":["GHSA-2464-fhr4-w9xw"],"related":[],"title":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used","description":"## Impact\n\nA memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.\n\n## Workaround\n\nEnsure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`.\nUpgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.","summary":"Next.js Image Optimization can be made to run attacker-supplied code through a memory bug in an upstream image library (sharp), reachable without authentication when SVG images are processed. The sources describe it as remote code execution on glibc-based Linux.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"next","fixed":["15.5.28"],"affected":">= 10.0.0, <= 15.5.27","ecosystem":"npm"},{"name":"next","fixed":["16.4.1"],"affected":">= 16.0.0, <= 16.4.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-1395","glibc","linux","next.js","node","package","self-hosted"],"not_affected_if":["default-config","managed-hosting","static-export"],"how_to_check":"Run `npm ls next sharp` and confirm next is 15.5.28 or later (or 16.4.1 or later) and sharp is 0.35.5 or later.\nCheck that the app serves or optimizes SVG images through next/image or /_next/image.","fix":"Upgrade next to 15.5.28 (15.x line) or 16.4.1 (16.x line), or ensure the resolved sharp version is at least 0.35.5.\nRedeploy after the upgrade; the sources do not say whether a runtime-only workaround exists.","status":"open","published_at":"2026-10-22T15:52:53+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:10:04+00:00","updated_at":"2026-10-23T20:10:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T20:10:04Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade next to 15.5.28 (15.x line) or 16.4.1 (16.x line), or ensure the resolved sharp version is at least 0.35.5.\nRedeploy after the upgrade; the sources do not say whether a runtime-only workaround exists.","summary":"Next.js Image Optimization can be made to run attacker-supplied code through a memory bug in an upstream image library (sharp), reachable without authentication when SVG images are processed. The sources describe it as remote code execution on glibc-based Linux.","category":"package","who_cares":["next.js","self-hosted","node","linux","glibc"],"confidence":0.7,"analyst_note":"Sources do not say whether SVG handling is required for exploitation or whether non-glibc (musl/Alpine) hosts are safe; check the GHSA page and the sharp advisory for exploit conditions.","how_to_check":"Run `npm ls next sharp` and confirm next is 15.5.28 or later (or 16.4.1 or later) and sharp is 0.35.5 or later.\nCheck that the app serves or optimizes SVG images through next/image or /_next/image.\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting","static-export","default-config"],"severity_if_unknown":"critical"},"cost_usd":0.000439,"input_tokens":2169,"output_tokens":444,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-1395':28B '-2464':16A,21A '0.35.5':128C 'api':9A 'attack':46B 'attacker-suppli':45B 'authent':61B 'automat':131C,148C 'base':78B,111C 'bug':52B 'code':4A,48B,73B,102C 'cwe':27B 'describ':69B 'discov':88C 'ensur':114C,145C 'equal':126C 'execut':5A,74B,103C 'fhr4':18A,23A 'fhr4-w9xw':17A,22A 'file':12A 'fix':134C,151C 'fresh':129C 'get':132C 'ghsa':15A,20A 'glibc':29B,77B,110C 'glibc-bas':76B,109C 'greater':123C 'host':36B 'imag':7A,38B,56B,64B,95C 'impact':80C 'instal':130C 'lead':98C 'librari':57B,92C 'linux':30B,79B,112C 'made':42B 'manag':147C 'memori':51B,83C 'memory-rel':82C 'next':25A,26A 'next.js':1A,31B,37B,106C,121C,139C,156C 'node':32B 'optim':8A,39B,96C 'packag':33B,146C 'patch':142C 'possibl':100C 'process':66B 'provid':149C 'rce':104C 'reachabl':59B 'relat':84C 'remot':3A,72B,101C 'run':44B,107C 'self':35B 'self-host':34B 'sharp':58B,118C,137C,154C 'sourc':68B 'suppli':47B 'svg':11A,63B 'unauthent':2A 'upgrad':138C 'upstream':55B,91C 'use':14A,93C,119C 'version':116C,135C,143C,152C 'vulner':85C 'w9xw':19A,24A 'without':60B 'workaround':113C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T15:52:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-2464-fhr4-w9xw","url":"https://github.com/advisories/GHSA-2464-fhr4-w9xw","severity":"critical","published_at":"2026-10-22T15:52:53+00:00","modified_at":"2026-10-22T15:52:56+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}