CVE-2026-96889: Next.js image optimization RCE via SVG

What it is

Next.js security release, 14 October 2026: “A memory-related vulnerability in an upstream library used for Image Optimization can lead to remote code execution when Next.js runs on glibc-based Linux.” Vercel rates it critical and says no login is needed.

NVD’s record for CVE-2026-96889 describes the upstream flaw: a use-after-free in librsvg when parsing an SVG with nested XML inclusions and duplicate entity declarations, which “could potentially” allow arbitrary code execution.

This was one of two fixes postponed from the September release because of upstream dependency delays.

How to check

1. Affected: next (npm) 10.0.0 through 15.5.27, and above 16.0.0 through 16.4.0.
2. Check which sharp version Next.js is using. 0.35.5 or later has the fix (commands below).

How to fix

1. Upgrade next to 16.4.1 (16.x) or 15.5.28 (15.x). Package managers then pull a fixed sharp automatically.
2. If you can’t upgrade yet, make sure the sharp used by Next.js is 0.35.5 or later.

npm ls next sharp
npm install next@16.4.1   # or next@15.5.28 on 15.5

Sources

• Next.js: Security update, October 14, 2026 ↗
• GitHub Security Advisory GHSA-2464-fhr4-w9xw ↗
• NVD: CVE-2026-96889 ↗