## Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

- 種別: advisory
- 重大度: critical
- 関連技術: nodejs, nextjs, cpp
- 公開日時: 2026-10-22T15:52:53.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-2464-fhr4-w9xw)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-2464-fhr4-w9xw

影響: npm:next >= 10.0.0, <= 15.5.27 → 15.5.28, npm:next >= 16.0.0, <= 16.4.0 → 16.4.1
A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.