Critical Next.js SVG Image Processing Vulnerability Could Enable Remote Code Execution
Vercel patched unauthenticated Next.js remote code execution in SVG image optimization, with no active exploitation reported.
Vercel released out-of-band Next.js patches for two critical remote code execution flaws and one high-severity denial-of-service bug. CVE-2026-96889 is a memory flaw in the upstream sharp library used by the Image Optimization API and can allow unauthenticated RCE on glibc-based Linux through SVG processing. A second critical issue affects App Router applications using Cache Components when a cached function returns multiple typed arrays, with a related React advisory and no workaround. Crafted requests can also exhaust CPU in App Router apps that expose a Server Action. Patches are in Next.js 16.4.1 and 15.5.28, and Vercel does not report active exploitation.
- CVE-2026-96889 is a critical memory flaw in sharp used for SVG optimization.
- Unauthenticated RCE applies on glibc Linux; musl and Alpine are not named.
- A second critical bug affects App Router Cache Components returning typed arrays.
- High-severity CPU denial of service hits App Router apps with Server Actions.
- Fixed in Next.js 16.4.1 and 15.5.28; sharp should be 0.35.5 or later.
Vulnerabilities mentionedAll →
- CVE-2026-968897.8<1%Use-After-Free in librsvg SVG Parsing via Nested XIncludes and Duplicate Entitiespublished · GNOME Project librsvg PoC
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-96889 | Use-After-Free in librsvg SVG Parsing via Nested XIncludes and Duplicate Entities |
Full article446 words · extracted from gbhackers.com · click to collapse
Vercel has released an out-of-band security update for Next.js that fixes two critical remote code execution (RCE) flaws and one high-severity denial-of-service (DoS) bug.
One of the critical flaws, CVE-2026-96889 (GHSA-2464-fhr4-w9xw), sits in the Image Optimization API and is triggered through SVG processing.
Next.js SVG vulnerability
According to security disclosures published by Vercel, the update was announced last week and includes two fixes postponed from the September 2026 security release because of delays in upstream dependencies.
Patches are now available in Next.js v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS). Vercel urges all users to patch.
The flaw is a memory-related vulnerability in an upstream library used by Next.js for image optimization. It can lead to unauthenticated remote code execution when Next.js runs on glibc-based Linux. Vercel rates it critical.
Because the flaw is unauthenticated and sits in a feature many production sites expose, attackers could target it without credentials.
Alpine and other musl-based environments are not named as affected in the advisory text. Teams should confirm their base images rather than assume they are safe.
Workaround: Ensure the version of sharp used by Next.js is 0.35.5 or later. Upgrading Next.js to a patched release makes package managers supply a fixed sharp version automatically.
The second critical flaw affects applications that use the App Router with Cache Components. It can lead to unauthenticated RCE when a use cache function returns multiple typed arrays. A related upstream advisory exists in React (GHSA-xqc2-xf4c-x3h3).
Vercel says there is no known workaround. It advises upgrading immediately, even if your application has no similar functions.
The high-severity flaw lets crafted requests drive excessive CPU usage in App Router applications that have at least one Server Action. The CPU load blocks other requests in the same process and causes denial of service.
A related React advisory is GHSA-h3gv-c5rc-p453. Applications using Pages Router, or with no Server Actions, are not vulnerable.
Update with the command for your release line by running npm install [email protected] for the 15.5 line or npm install [email protected] for the 16.4 line.
Security teams should also take steps to check lockfiles to confirm sharp is 0.35.5 or later, inventory applications that use Cache Components or Server Actions, review image optimization endpoints and logs for unusual SVG requests, and rebuild and redeploy containers so the patched dependencies are actually shipped.
Next.js is widely used in production, so unauthenticated RCE bugs in default features raise the risk of rapid exploitation once technical details circulate. Vercel’s advisory does not mention active exploitation.
Organizations should still treat patching as urgent. Researchers can report issues through Vercel’s Open Source Bug Bounty on HackerOne, and questions can go to [email protected].