Index

Search

Search the public record. Drafts and scheduled notes are not included.

news

Next.js Image Optimization SVG RCE is CVE-2026-96889

Vercel fixed a critical unauthenticated RCE in the Next.js Image Optimization API in 15.5.28 and 16.4.1. The root cause is a librsvg use-after-free reached through sharp. The Next.js advisory scores it 9.5. Not in CISA KEV.

Published 3h ago

CriticalPoC Available

CVE-2026-96889

Next.js Image Optimization SVG RCE via librsvg and sharp

RCE

Published 33h ago