Critical Next.js SVG Image Processing Vulnerability Could Enable Remote Code Execution

Vercel has released an out-of-band security update for Next.js that fixes two critical remote code execution (RCE) flaws and one high-severity denial-of-service (DoS) bug.

One of the critical flaws, CVE-2026-96889 (GHSA-2464-fhr4-w9xw), sits in the Image Optimization API and is triggered through SVG processing.

Next.js SVG vulnerability

According to security disclosures published by Vercel, the update was announced last week and includes two fixes postponed from the September 2026 security release because of delays in upstream dependencies.

Patches are now available in Next.js v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS). Vercel urges all users to patch.

The flaw is a memory-related vulnerability in an upstream library used by Next.js for image optimization. It can lead to unauthenticated remote code execution when Next.js runs on glibc-based Linux. Vercel rates it critical.

Because the flaw is unauthenticated and sits in a feature many production sites expose, attackers could target it without credentials.

Alpine and other musl-based environments are not named as affected in the advisory text. Teams should confirm their base images rather than assume they are safe.

Workaround: Ensure the version of sharp used by Next.js is 0.35.5 or later. Upgrading Next.js to a patched release makes package managers supply a fixed sharp version automatically.

The second critical flaw affects applications that use the App Router with Cache Components. It can lead to unauthenticated RCE when a use cache function returns multiple typed arrays. A related upstream advisory exists in React (GHSA-xqc2-xf4c-x3h3).

Vercel says there is no known workaround. It advises upgrading immediately, even if your application has no similar functions.

The high-severity flaw lets crafted requests drive excessive CPU usage in App Router applications that have at least one Server Action. The CPU load blocks other requests in the same process and causes denial of service.

A related React advisory is GHSA-h3gv-c5rc-p453. Applications using Pages Router, or with no Server Actions, are not vulnerable.

Update with the command for your release line by running npm install next@15.5.28 for the 15.5 line or npm install next@16.4.1 for the 16.4 line.

Security teams should also take steps to check lockfiles to confirm sharp is 0.35.5 or later, inventory applications that use Cache Components or Server Actions, review image optimization endpoints and logs for unusual SVG requests, and rebuild and redeploy containers so the patched dependencies are actually shipped.

Next.js is widely used in production, so unauthenticated RCE bugs in default features raise the risk of rapid exploitation once technical details circulate. Vercel’s advisory does not mention active exploitation.

Organizations should still treat patching as urgent. Researchers can report issues through Vercel’s Open Source Bug Bounty on HackerOne, and questions can go to security@vercel.com.