GHSA-2464-fhr4-w9xw: the Next.js SVG image optimizer RCE, who is affected and the fix

What GHSA-2464-fhr4-w9xw is, in plain words

When a page shows a picture with next/image, the browser asks your server for /_next/image?url=..., and the Next.js Image Optimization API decodes, resizes and re-encodes it. The decoding is done by sharp, a Node.js image library built on libvips, whose bundled decoders include librsvg for SVG files.

Vercel's advisory, published with the fix on 14 October 2026, says a memory-related flaw in "an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux." Remote code execution means a stranger runs their own commands on your server, with everything the Node.js process can reach: environment variables, database credentials, API keys. No account is needed.

The upstream library is librsvg. The advisory links CVE-2026-96889, a librsvg use-after-free (code that keeps using memory it already released) published by Red Hat on 23 September 2026 and also named by sharp's advisory, GHSA-wq5f-xc86-pv6w. Next.js did not change its own image code: the fix commits only move the sharp range from 0.35.4 to 0.35.5, the release that ships librsvg 2.63.2.

Severity and exploitation status

The gap between 7.8 and 9.5 is context: on a desktop someone has to open a bad file, while the Image Optimization API decodes images on request for anyone on the internet.

The Hacker News reports that Rafael B. Dias, who reported the librsvg bug, says it is the weakness behind September's next/og advisory, for which a working exploit has been published. We found no report of this advisory being used against Next.js apps.

Who is affected

Your app is in the advisory's scope when both of these are true:

1. It runs next 10.0.0 to 15.5.27, or 16.0.0 to 16.4.0.
2. The Next.js server runs on glibc-based Linux: Debian, Ubuntu, Red Hat, Amazon Linux, and Docker images built on them, such as the official node images without alpine in the tag.

The advisory names no setting that limits exposure. Some press coverage ties it to images.dangerouslyAllowSVG: true, which neither the advisory nor Vercel's post mentions, and the November 2026 release fixed a way for an image from an allowed source to get past dangerouslyAllowSVG: false and reach the SVG decoder (GHSA-7qx7-33qx-rqx2, fixed in 15.5.29 and 16.4.5). Do not count on the default config. On Alpine (musl), macOS and Windows the advisory is silent, but sharp 0.35.5 updated librsvg in all its prebuilt binaries: upgrade there too.

If a route of yours builds a social image with ImageResponse from visitor input, the same sharp fix covers that path too. The Next.js security guide covers the other server settings worth reviewing.

How to check your Next.js and sharp versions

Two versions matter: next, and the sharp it loads. Check what your lockfile resolves, not the range in package.json. At the root of the project:

# next: affected from 10.0.0 to 15.5.27 and from 16.0.0 to 16.4.0
npm ls next
pnpm why next
yarn why next

# sharp: the advisory asks for 0.35.5 or later
npm ls sharp
pnpm why sharp
yarn why sharp

# Known advisories in your production dependencies
npm audit --omit=dev

The 15.x trap. Next.js 15.5.28 and 15.5.29 still accept sharp 0.34.x (their range is ^0.34.3 || ^0.35.5), while sharp's advisory covers every version below 0.35.5. In our test, a 15.5.20 project kept sharp 0.34.5 after npm install [email protected], and npm audit stopped flagging next but still flagged sharp under GHSA-wq5f-xc86-pv6w. From 16.4.1 the range is ^0.35.5, so the upgrade pulls the fixed version.

On 14.x and older, next does not list sharp: if npm ls sharp prints a version, your project added it. If your build compiles sharp against the system libvips, the system librsvg counts: sharp's advisory asks for 2.63.2, and distributions such as Red Hat ship patched builds under their own version numbers.

How to fix GHSA-2464-fhr4-w9xw

1. 1

   Upgrade Next.js

   16.4.1 and 15.5.28 are the first fixed releases. Go to the latest on your line, from the November 2026 security release: npm install [email protected] or npm install [email protected].

2. 2

   Make sure sharp is 0.35.5 or later

   Run npm ls sharp again. If a copy older than 0.35.5 remains, which happens on 15.x, run npm update sharp, or npm install sharp@^0.35.5 if sharp is in your own dependencies. Add the override below so an old copy cannot come back.

3. 3

   Commit the lockfile and rebuild

   The fix reaches production only through the lockfile. Rebuild without a cached install layer.

4. 4

   Retire old deployments

   Preview and branch deployments keep the build they were made with, as Netlify's notice warns. Delete the ones you no longer need.

{
  "overrides": { "sharp": "^0.35.5" }
}

What people miss after the upgrade

• Your own `sharp` code. If your app calls sharp directly, for avatars or uploads, sharp's advisory applies there too. Its workaround for code stuck on an older version is sharp.block({ operation: ["VipsForeignLoadSvg"] }), which stops SVG decoding.
• The Node.js binary. sharp's advisory says that to avoid code execution, the node binary should be built as a Position Independent Executable (PIE). Most Linux package managers build Node.js that way; the official Node.js binaries do not. That is hardening, not the fix.

• npm ls next shows 16.4.5 or 15.5.29 (at least 16.4.1 or 15.5.28) for every app.
• npm ls sharp shows 0.35.5 or later for every copy, including in other workspaces.
• The deployed build came from the new lockfile, not a cached image, and npm audit --omit=dev lists neither GHSA-2464-fhr4-w9xw on next nor GHSA-wq5f-xc86-pv6w on sharp.
• If an affected version ran on glibc Linux and crashed around /_next/image requests without explanation, investigate and rotate the server's secrets.

Keybrum does not test this advisory on a live app: it never runs remote code execution payloads, and no harmless request proves this flaw, so your version check is the answer. On the same endpoint, Keybrum's web.nextjs-image-ssrf attack checks whether the optimizer fetches hosts it should refuse, the precondition behind CVE-2026-94483.

Related Next.js advisories

• GHSA-673q-mjm6-r5xr: the other critical advisory of 14 October, code execution in use cache functions.
• CVE-2026-94482: denial of service through Server Actions, fixed in the same releases.
• CVE-2026-94483: the image optimizer SSRF fixed in 16.3.8.
• CVE-2025-55182: React2Shell, exploited in the wild.

Timeline