Critical 9.5
Vercel · Next.js · CVE-2026-96889
Next.js image optimisation can be used to run code on Linux servers
A memory bug in sharp, the image library Next.js uses for its Image Optimisation API, can let an unauthenticated attacker run code through a crafted SVG when the app runs on glibc-based Linux. The same out-of-band release fixed a second critical remote code execution flaw in App Router apps using Cache Components ("use cache" functions returning typed arrays, GHSA-673q-mjm6-r5xr, no CVE yet) and a high-severity denial of service in Server Actions. No in-the-wild exploitation has been reported.
- Affected
- Next.js 10.0.0 to 15.5.27 and 16.0.x to 16.4.0. The image flaw needs glibc-based Linux; the use cache flaw needs App Router with Cache Components; the denial of service needs App Router with at least one Server Action.
- What to do
- Upgrade to next@15.5.28 or next@16.4.1 and redeploy. Vercel says to upgrade even if your app has no use cache functions, as there is no workaround for that flaw. For the image flaw alone, making sure Next.js uses sharp 0.35.5 or later also fixes it.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
- Why it’s here
- Critical, unauthenticated, and in the framework our own platform and many client sites are built on.