CVE-2026-96889
Next.js Image Optimization SVG RCE via librsvg and sharp
Critical unauthenticated RCE in the Next.js Image Optimization API when SVG files are processed. The root cause is a use-after-free in librsvg, used through sharp. The Next.js advisory scores it 9.5. Fixed in Next.js 15.5.28 and 16.4.1, and in sharp 0.35.5. Not in CISA KEV. A public PoC for the librsvg bug exists.
- CVSS
- 9.5
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- Class
- RCE
- Status
- PoC Available
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Vercel
- Products
- Next.js, sharp, librsvg
- Affected
- Next.js 10.0.0 through 15.5.27, and 16.0.0 through 16.4.0, when running on glibc-based Linux. sharp before 0.35.5. librsvg before 2.63.2.
- Fixed
- Next.js 15.5.28 and 16.4.1. sharp 0.35.5 (librsvg 2.63.2).
- CWE
- CWE-416
- Published
- 14 Oct 2026
- Updated
- 15 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-96889 is a use-after-free in librsvg, the SVG library bundled with sharp. Next.js uses sharp for Image Optimization. Vercel says the flaw can give unauthenticated remote code execution when Next.js runs on glibc-based Linux.
The Next.js advisory, GHSA-2464-fhr4-w9xw, rates it Critical with a CVSS 4.0 score of 9.5. The sharp advisory, GHSA-wq5f-xc86-pv6w, rates the library bug High at 8.9. NVD is still awaiting analysis. It lists a secondary 7.8 score from Red Hat under CVSS 3.1, with CWE-416.
Affected Next.js versions are 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0. The fixes are 15.5.28 and 16.4.1. The workaround is to make sure sharp is 0.35.5 or later.
A public repository by the researcher who found the librsvg bug includes a PoC for it. It is not specific to the Next.js route. It is not in the CISA KEV catalog, and no exploitation is reported. ThreatWire does not republish any exploit input.