Article
Next.js and Node.js Security Updates, October 2026: What to Patch First
Next.js 15.5.28 and 16.4.1 fix two critical remote code execution flaws. Node.js 26.12.1, 24.22.1 and 22.23.4 fix ten CVEs. See the patch table and…
Read more
Exploited vulnerability
Next.js Image Optimization remote code execution (CVE-2026-96889)
A critical flaw in the Next.js Image Optimization API.
- CVE ID
- CVE-2026-96889
- CVSS
- 9.5 Critical (CVSS v4.0, Next.js GitHub advisory)
- Affected product
- Next.js (Image Optimization API, with the sharp and librsvg libraries)
- Exploited
- Unknown
- Published
- September 2026
In short
CVE-2026-96889 is a critical flaw in the Next.js Image Optimization API. Vercel says a memory flaw in an upstream library can lead to unauthenticated remote code execution when SVG files are used and Next.js runs on glibc-based Linux. The Next.js advisory rates it 9.5 on CVSS v4.0. It is fixed in Next.js 15.5.28 and 16.4.1.
- CVECVE-2026-96889
- ProductVercel Next.js (Image Optimization API, with the sharp and librsvg libraries)
- Fix Steps5actions listedFind your Next.js version · Update Next.js
What it allows
The Next.js advisory says a memory-related flaw in an upstream library used for Image Optimization can lead to remote code execution when Next.js runs on glibc-based Linux. Its CVSS v4.0 vector rates the flaw Critical. It is reachable over the network, needs no privileges and no user interaction, but has attack requirements present.
The NVD record for the same CVE id describes the upstream cause in librsvg. When the library parses an SVG with nested XML includes and a duplicate entity declaration, it can free an entity that is still in use. NVD says an attacker could cause a denial of service or run code. Red Hat scored the library flaw 7.8 on CVSS v3.1 with a local attack vector and user interaction required. The Next.js advisory scores the Next.js case separately.
The NVD record carries a CISA coordinator entry dated 25 September 2026 with exploitation marked "poc", automatable "no" and technical impact "total". In our dark web and Telegram sources, a vulnerability feed listed a public lab proof of concept for the Next.js case on 16 October 2026. We did not open it.
Who is affected
The advisory lists Next.js 10.0.0 to 15.5.27 and the 16 line above 16.0.0 up to 16.4.0 as affected. The patched versions are 15.5.28 and 16.4.1. Vercel's post names 16.4 as the Active LTS line and 15.5 as the Maintenance LTS line.
The advisory ties the flaw to Next.js running on glibc-based Linux and to SVG files in the Image Optimization API. It does not say that other operating systems or hosts are affected, and it makes no statement about managed hosting. As a workaround, Vercel says to make sure the sharp version used by Next.js is 0.35.5 or later. Upgrading Next.js brings a fixed sharp version automatically.
NVD also lists CVE-2026-114111, a record from VulnCheck. It says sharp before 0.35.5 bundles the affected librsvg and can lead to code execution on glibc-based Linux.
For the full list of fixes shipped on 14 October, including the use cache and Server Actions flaws, read our Next.js and Node.js patch guide.
Timeline
- 23 Sep 2026
The RustSec database and the NVD record publish the upstream librsvg use-after-free flaw that carries this CVE id.
- 25 Sep 2026
The CISA coordinator entry on the NVD record marks exploitation as "poc", automatable as "no" and technical impact as "total".
- 14 Oct 2026
Vercel publishes Next.js 15.5.28 and 16.4.1 and the advisory GHSA-2464-fhr4-w9xw, rated Critical.
What to do
-
Find your Next.js version
Run npm ls next in each project and in each container image. Anything from 10.0.0 to 15.5.27, or 16.x above 16.0.0 up to 16.4.0, is in scope.
-
Update Next.js
Install next@15.5.28 for the 15.5 line or next@16.4.1 for the 16.4 line, rebuild the image and redeploy. Vercel says this also brings a fixed sharp.
-
Check sharp
Run npm ls sharp. If you cannot update Next.js today, install sharp 0.35.5 or later, as the Vercel workaround says, and redeploy.
-
Check where it runs
The advisory names glibc-based Linux. Note which of your containers and servers use it, and do the exposed image endpoints first.
-
Look for signs of abuse
Review logs of the image endpoint for unusual SVG requests, and watch for web processes that start shells or download tools. The vendor advisories publish no indicators of compromise.
Questions
What is CVE-2026-96889?
It is a critical flaw in the Next.js Image Optimization API. A memory flaw in an upstream SVG library can lead to unauthenticated remote code execution on glibc-based Linux. The Next.js advisory rates it 9.5 on CVSS v4.0.
Which Next.js versions fix it?
Next.js 15.5.28 and 16.4.1, published on 14 October 2026. Versions from 10.0.0 to 15.5.27 and the 16 line above 16.0.0 up to 16.4.0 are listed as affected.
Why does NVD show a lower score?
The NVD record describes the library flaw alone, which Red Hat scored 7.8 on CVSS v3.1 with a local attack vector. The Next.js advisory scores the Next.js case separately, at 9.5 on CVSS v4.0 with a network attack vector.
Is CVE-2026-96889 exploited in the wild?
We found no statement of exploitation from Vercel, and the CVE is not in the CISA Known Exploited Vulnerabilities catalog as of 21 October 2026. CISA's entry in the NVD record marks exploitation as proof of concept, so patch now.
In our research
- Next.js and Node.js Security Updates, October 2026: What to Patch First October 2026
- Remote code execution (RCE) Glossary term
Sources
- Next.js Security Update for Upstream Vulnerabilities (14 October 2026) Next.js
- Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used GitHub
- CVE-2026-96889 NVD
- RUSTSEC-2026-0305: librsvg use-after-free when XML includes have duplicated entities RustSec
- Known Exploited Vulnerabilities catalog CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 51 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 26 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 57 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 41 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 54 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 106 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.