Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 4, published 22 October 2026.

Which products and versions are affected?

next (npm) >= 10.0.0, <= 15.5.27, SEMVER:introduced=10.0.0,fixed=15.5.28; Vercel Next.js 10.0.0 through 15.5.27, 16.0.0 through 16.4.0.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Next.js unauthenticated remote code execution in Image Optimization API

Q: Is there a fix for This vulnerability?

Yes. next (npm): upgrade to 15.5.28 or later. Until then: Ensure the Sharp image library dependency is updated to version 0.35.5 or later, either by upgrading Next.js to the patched versions or by manually updating the Sharp package. Fresh installations automatically receive the fixed version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network.

Q: Am I affected?

Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: critical · CVSS 4 · Published 2026-10-22

Next.js is a popular web application framework for building and deploying Node.js applications. A memory vulnerability in the image optimization component can allow unauthenticated attackers to execute arbitrary code on servers running Next.js on glibc-based Linux systems. Successful exploitation could lead to complete system compromise, data theft, and service disruption.

Technologies: next (npm), Vercel Next.js. Vendors: npm, Vercel.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 4, published 22 October 2026.
Which products and versions are affected?: next (npm) >= 10.0.0, <= 15.5.27, SEMVER:introduced=10.0.0,fixed=15.5.28; Vercel Next.js 10.0.0 through 15.5.27, 16.0.0 through 16.4.0.
Is there a fix for This vulnerability?: Yes. next (npm): upgrade to 15.5.28 or later. Until then: Ensure the Sharp image library dependency is updated to version 0.35.5 or later, either by upgrading Next.js to the patched versions or by manually updating the Sharp package. Fresh installations automatically receive the fixed version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

next (npm): upgrade to 15.5.28 or later
```
npm install next@15.5.28
```

Ensure the Sharp image library dependency is updated to version 0.35.5 or later, either by upgrading Next.js to the patched versions or by manually updating the Sharp package. Fresh installations automatically receive the fixed version.

Technical details

A memory-related vulnerability exists in the Sharp library used by Next.js for image optimization, triggered when processing SVG files. The vulnerability allows unauthenticated remote code execution on glibc-based Linux systems when the Image Optimization API processes user-supplied SVG input. An attacker can craft a malicious SVG file to trigger the memory flaw and gain arbitrary code execution under the privileges of the Next.js process.

Affected products

Vercel Next.js 10.0.0 through 15.5.27, 16.0.0 through 16.4.0

Timeline

2026-10-14: disclosed
2026-10-22: advisory

References

https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.