{"id":"ghsa-ghsa-2464-fhr4-w9xw","seq":309598,"kind":"advisory","title":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used","url":"https://github.com/advisories/GHSA-2464-fhr4-w9xw","permalink":"https://vulnpulse.app/items/ghsa-ghsa-2464-fhr4-w9xw","summary":"影響: npm:next >= 10.0.0, <= 15.5.27 → 15.5.28, npm:next >= 16.0.0, <= 16.4.0 → 16.4.1\nA memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.","severity":"critical","techs":["nodejs","nextjs","cpp"],"cves":[],"tags":["GHSA-2464-fhr4-w9xw","next","next"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T15:52:53.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}