GHSA-2464-fhr4-w9xw Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
- Exploited in the wild
- Not known
- Fix
- Available
What is GHSA-2464-fhr4-w9xw?
GHSA-2464-fhr4-w9xw is a vulnerability in next, published on 22 Oct 2026.
Official description
Impact
A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.
Workaround
Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp.
Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.
Which versions are affected by GHSA-2464-fhr4-w9xw?
4 open source packages ship an affected version, including next.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 10.0.0 | 15.5.28 |
next npm | From 10.0.0 | 15.5.28 |
next npm | From 16.0.0 | 16.4.1 |
next npm | From 16.0.0 | 16.4.1 |
How do I fix GHSA-2464-fhr4-w9xw?
Upgrade next to a fixed version for your release line: 15.5.28 or 16.4.1.
Is GHSA-2464-fhr4-w9xw being exploited?
There is no known exploitation of GHSA-2464-fhr4-w9xw in the wild and no public exploit code.