Next.js Image Optimization remote code execution (CVE-2026-96889)

The Next.js advisory says a memory-related flaw in an upstream library used for Image Optimization can lead to remote code execution when Next.js runs on glibc-based Linux. Its CVSS v4.0 vector rates the flaw Critical. It is reachable over the network, needs no privileges and no user interaction, but has attack requirements present.

The NVD record for the same CVE id describes the upstream cause in librsvg. When the library parses an SVG with nested XML includes and a duplicate entity declaration, it can free an entity that is still in use. NVD says an attacker could cause a denial of service or run code. Red Hat scored the library flaw 7.8 on CVSS v3.1 with a local attack vector and user interaction required. The Next.js advisory scores the Next.js case separately.

The NVD record carries a CISA coordinator entry dated 25 September 2026 with exploitation marked "poc", automatable "no" and technical impact "total". In our dark web and Telegram sources, a vulnerability feed listed a public lab proof of concept for the Next.js case on 16 October 2026. We did not open it.

The researcher who found the librsvg bug, who goes by rafabd1 on GitHub, keeps a public write-up on GitHub. The repository was created on 21 September 2026 and last changed on 15 October. The write-up says the author confirmed command execution through both Next.js routes, the Image Optimization API and the next/og ImageResponse route, and on a Ghost CMS site.

It also says a working public exploit exists for the ImageResponse route, tied to one pinned build, and that there is no universal exploit for the whole chain. The author says a full technical write-up is still to come. These are the author's claims. We did not run any of the code.

The advisory lists Next.js 10.0.0 to 15.5.27 and the 16 line above 16.0.0 up to 16.4.0 as affected. The patched versions are 15.5.28 and 16.4.1. Vercel's post names 16.4 as the Active LTS line and 15.5 as the Maintenance LTS line.

The advisory ties the flaw to Next.js running on glibc-based Linux and to SVG files in the Image Optimization API. It does not say that other operating systems or hosts are affected, and it makes no statement about managed hosting. As a workaround, Vercel says to make sure the sharp version used by Next.js is 0.35.5 or later. Vercel says upgrading Next.js brings a fixed sharp version automatically. The 15.5.28 package manifest still accepts the sharp 0.34 line, so on the 15.5 line confirm 0.35.5 or later in the built image.

NVD also lists CVE-2026-114111, a record from VulnCheck. It says sharp before 0.35.5 bundles the affected librsvg and can lead to code execution on glibc-based Linux.

The Next.js use cache flaw GHSA-673q-mjm6-r5xr, fixed the same day, has its own page. For the full list of fixes shipped on 14 October, read our Next.js and Node.js patch guide. To check that the image fix reached your build, read our Next.js RCE patch check.