Next.js Image Optimization SVG RCE is CVE-2026-96889

What happened

On 14 October 2026 Vercel released Next.js 16.4.1 and 15.5.28. The update fixes three issues. The worst is CVE-2026-96889, tracked as GHSA-2464-fhr4-w9xw.

It is an unauthenticated remote code execution bug. It sits in the Image Optimization API when SVG files are processed. The cause is a memory flaw, a use-after-free (CWE-416), in librsvg. Next.js reaches librsvg through sharp.

Vercel rates it Critical. The Next.js advisory gives a CVSS 4.0 score of 9.5. The vendor says the bug can lead to code execution when Next.js runs on glibc-based Linux.

Who is affected

Next.js 10.0.0 through 15.5.27 is affected. So is 16.0.0 through 16.4.0. The fixes are 15.5.28 and 16.4.1.

The risk applies to Next.js on glibc-based Linux. That includes common Debian and Ubuntu containers. Vercel and the sharp maintainer scope code execution to that platform.

On the sharp side, versions before 0.35.5 are affected. sharp 0.35.5 ships librsvg 2.63.2. It was released on 27 September 2026.

On Netlify, impact is limited. Netlify says next/image runs on its Image CDN, not in your function. The same flaw can be reached through next/og ImageResponse, which runs in your function. Netlify says the effect there is a crashed invocation, not code execution.

What is confirmed

Vercel confirmed the issue in its 14 October security update and in advisory GHSA-2464-fhr4-w9xw. The sharp maintainer confirmed the upstream bug in GHSA-wq5f-xc86-pv6w. That advisory rates the library flaw High, 8.9.

NVD lists CVE-2026-96889 as awaiting analysis. It carries a secondary CVSS 3.1 score of 7.8 from Red Hat, and CWE-416. The NVD entry describes the librsvg bug itself, not the Next.js route. CISA's SSVC data in NVD marks exploitation as "poc".

The CVE is not in the CISA KEV catalog. We checked catalog version 2026.10.14. No source we read reports exploitation in the wild.

A public repository from the researcher who found the librsvg bug includes a PoC for it. It covers the library bug, not the Next.js Image Optimization route specifically. ThreatWire did not run it. We do not publish exploit input.

What is not confirmed

The 9.5 score comes from the Next.js advisory. NVD has not published its own score for the Next.js impact.

Whether exploitation has started is not known. There are no reports of attacks against Next.js through this bug.

Vercel's wording on the glibc condition is short. Other runtime conditions may apply. The sharp advisory says a Node.js binary built as a position independent executable avoids the RCE. It warns that official Node.js binaries are not built that way. Do not rely on that. Patch.

What to do

Upgrade Next.js to 15.5.28 or 16.4.1. Then redeploy.

Check the sharp version that actually ships. Run npm ls sharp. You want 0.35.5 or later.

Check the lockfile on 15.x. Next.js 15.5.28 accepts sharp 0.34.x or 0.35.5 or later. An old lockfile can keep the vulnerable 0.34.x. Pin sharp to 0.35.5 and reinstall if needed.

Commit the updated lockfile. Rebuild your container image. Redeploy it.

If you cannot upgrade at once, make sure sharp is 0.35.5 or later. The sharp maintainer also describes a code option to block SVG decoding. Blocking SVG is a stopgap, not a fix.

The same release also fixes two other bugs. GHSA-673q-mjm6-r5xr is a critical RCE in use cache functions that return typed arrays. It affects Next.js 16.x with Cache Components. GHSA-p3m5-59mp-jv5r is a high-severity denial of service in App Router Server Actions. Upgrading covers all three.

Sources: Next.js security update of 14 October 2026, the Next.js and sharp GitHub advisories, NVD, CISA KEV (not listed), Netlify's changelog, and HOL's operator write-up.