A critical Next.js RCE vulnerability, tracked as CVE-2026-96889, lets attackers run code via untrusted SVG files. Vercel disclosed the flaw on October 14, 2026, rating it Critical with a CVSS score of 9.5. The bug lives in Sharp, the image library Next.js uses for its Image Optimization API. Any app running on glibc-based Linux with SVG optimization enabled carries the exposure. Two more critical patches shipped the same day, so this month’s upgrade matters more than usual.
What Is the Next.js RCE Vulnerability (CVE-2026-96889)
CVE-2026-96889 is a critical remote code execution flaw in Next.js, the React framework Vercel maintains. GitHub tracks it as advisory GHSA-2464-fhr4-w9xw. Vercel published the advisory on October 14, 2026, and GitHub added it to the Advisory Database eight days later. The flaw carries a CVSS v4 score of 9.5, the top end of the critical range. Its scoring vector requires no privileges or user interaction to trigger it.
Next.js depends on sharp, an npm package, to resize and convert images. Sharp in turn bundles librsvg, a C library that parses SVG files. Framework maintainers treat these dependencies the way broader enterprise development tools treat any third-party component: trust, but verify. A single memory bug in librsvg, not in Next.js’s own code, created the exposure.
How the SVG Image Optimization Exploit Works
Sharp calls librsvg to render SVG files during optimization. Vercel’s security advisory describes a memory-related vulnerability in that upstream library. Researchers classify the bug as CWE-416, a use-after-free condition. A separate advisory assigns the librsvg defect its own identifier, CVE-2026-114111. An attacker only needs to supply a crafted SVG file for Sharp to process. On glibc-based Linux servers, that malformed input can corrupt memory and execute attacker-controlled code.
Next.js does not optimize SVG files by default. Teams must set dangerouslyAllowSVG to true in next.config.js to enable it. That flag exists because SVG files can embed scripts, so Next.js warns against turning it on for untrusted input. The same flaw also hits apps that call next/og on the Node.js runtime, since that feature shares the sharp pipeline. Whether the bug causes a crash or full code execution depends on the server’s Node.js build. Sharp’s maintainer says Node.js doesn’t harden its official binaries against this class of memory attack.
Which Next.js Versions and Setups Are at Risk
The vulnerability spans a wide range of Next.js releases. Versions 10.0.0 through 15.5.27 are affected, as are 16.0.0 through 16.4.0. Vercel fixed it in 15.5.28 for the Maintenance LTS line and in 16.4.1 for Active LTS. Both patched releases bundle sharp 0.35.5 or later, which closes the librsvg gap directly. Teams running Next.js 15 should still check their lockfile, since an upgrade can leave an older sharp version in place.
Exploitation also needs a specific hosting setup. Only glibc-based Linux hosts face the code-execution risk, since the memory corruption behaves differently elsewhere. Vercel’s advisory does not name Alpine Linux or musl-based images as affected. Teams should confirm their base image rather than assume they’re safe. An app must also pass untrusted SVG files into image optimization or next/og before the risk applies.
A static marketing site with no user uploads carries a much smaller blast radius. Platforms that let users upload avatars or logos face more exposure.
Two More Critical Flaws Patched the Same Day
Vercel shipped two other high-severity fixes in the same release. One is a critical code-execution bug in the use cache function, tracked separately as GHSA-673q-mjm6-r5xr. It affects Next.js 16.0.0 through 16.4.0 when an App Router project enables Cache Components. The root cause lives in React’s server components packages, not in Next.js itself. No workaround exists, so upgrading to 16.4.1 is the only fix.
The third flaw is a high-severity denial-of-service bug in Server Actions, GHSA-p3m5-59mp-jv5r. It affects Next.js 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0. Only App Router apps with at least one Server Action face the risk. A crafted request can push a server process to 100% CPU, stalling every other request it handles. Pages Router apps, or apps with no Server Actions at all, stay unaffected. As of mid October 2026, Vercel’s advisories reported no public exploitation of any of the three flaws.
How to Patch and Mitigate the Vulnerability
Patching starts with a version bump. Run npm install [email protected] for the Active LTS line, or npm install [email protected] to stay on Next.js 15. Either command pulls in sharp 0.35.5 automatically, since package managers resolve dependencies to the versions each release declares. After upgrading, check your lockfile directly, since some Next.js 15 setups kept an older sharp release in place. Run npm ls sharp and confirm the version reads 0.35.5 or higher.
Rebuild and redeploy every container that bundles Next.js, not just the ones touching images directly. Stale images in production keep the vulnerable sharp version alive even after your repository looks patched. This kind of fast turnaround matters more as application security budgets grow. Analysts project the DevSecOps market will reach $45.93 billion, reflecting how much teams now spend closing exactly these gaps. If you cannot upgrade immediately, remove dangerouslyAllowSVG from next.config.js to block SVG optimization entirely. Updating sharp alone to 0.35.5 also works as an interim step.
Key Takeaways
- CVE-2026-96889 is a critical RCE in Next.js Image Optimization, scored CVSS 9.5.
- The bug lives in Sharp’s bundled librsvg library, not in Next.js’s own code.
- Affected versions span 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0.
- Fixes shipped in Next.js 15.5.28 and 16.4.1, both bundling sharp 0.35.5.
- Two more critical and high-severity flaws landed in the same October 14 patch.
Frequently Asked Questions About the Next.js RCE Vulnerability
What Is CVE-2026-96889?
CVE-2026-96889 is a critical remote code execution flaw in Next.js’s Image Optimization API. It stems from a memory bug in librsvg, reached through the sharp image library.
Which Next.js Versions Are Vulnerable?
Versions 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0 are affected. Next.js 15.5.28 and 16.4.1 both fix it.
Do I Need dangerouslyAllowSVG Enabled to Be at Risk?
Yes, for the Image Optimization API path. Next.js skips SVG optimization by default, so you must turn the setting on before attacker-supplied SVGs can reach sharp.
Does This Vulnerability Affect Alpine Linux Deployments?
Vercel’s advisory names glibc-based Linux as the affected platform. It does not list musl-based images like Alpine, though teams should confirm their own base image rather than assume safety.
Has CVE-2026-96889 Been Exploited in the Wild?
As of mid October 2026, Vercel’s advisories reported no public exploitation of any of the three flaws patched that day. That can change quickly as technical details circulate.
How Do I Check if My App Uses a Vulnerable Sharp Version?
Run npm ls sharp from your project root. If it reports a version earlier than 0.35.5, upgrade Next.js or update sharp directly.
Final Thoughts
CVE-2026-96889 shows how a single upstream library can undermine an otherwise well-maintained framework. Next.js itself had no new code flaw. The risk came entirely from sharp’s bundled librsvg dependency. Upgrade to Next.js 16.4.1 or 15.5.28 now, and confirm sharp reads 0.35.5 or later in your lockfile. Rebuild your containers afterward, since a patched repository means little if production still runs an old image. Then check whether dangerouslyAllowSVG is actually necessary for your app, and remove it if it isn’t.
Photo by Štefan Štefančík; Unsplash
Rashan is a seasoned technology journalist and visionary leader serving as the Editor-in-Chief of DevX.com, a leading online publication focused on software development, programming languages, and emerging technologies. With his deep expertise in the tech industry and her passion for empowering developers, Rashan has transformed DevX.com into a vibrant hub of knowledge and innovation. Reach out to Rashan at [email protected]
