---
id: "GHSA-2464-fhr4-w9xw"
kind: "vulnerability"
aliases: ["GHSA-2464-fhr4-w9xw"]
title: "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "next", "fixed": ["15.5.28"], "affected": ">= 10.0.0, <= 15.5.27", "ecosystem": "npm"}, {"name": "next", "fixed": ["16.4.1"], "affected": ">= 16.0.0, <= 16.4.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-1395", "glibc", "linux", "next.js", "node", "package", "self-hosted"]
not_affected_if: ["default-config", "managed-hosting", "static-export"]
published_at: "2026-10-22T15:52:53+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T20:10:04+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-2464-fhr4-w9xw", "first_seen_at": "2026-10-23T19:11:32+00:00"}]
---

# Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

Next.js Image Optimization can be made to run attacker-supplied code through a memory bug in an upstream image library (sharp), reachable without authentication when SVG images are processed. The sources describe it as remote code execution on glibc-based Linux.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:next affected >= 10.0.0, <= 15.5.27 fixed 15.5.28
- npm:next affected >= 16.0.0, <= 16.4.0 fixed 16.4.1

## How to check

Run `npm ls next sharp` and confirm next is 15.5.28 or later (or 16.4.1 or later) and sharp is 0.35.5 or later.
Check that the app serves or optimizes SVG images through next/image or /_next/image.

## Fix

Upgrade next to 15.5.28 (15.x line) or 16.4.1 (16.x line), or ensure the resolved sharp version is at least 0.35.5.
Redeploy after the upgrade; the sources do not say whether a runtime-only workaround exists.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-2464-fhr4-w9xw

## From the sources

## Impact

A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.

## Workaround

Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`.
Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_