Security1 hOctober 17, 2026, 08:39

CVE-2026-96889: Critical RCE in Next.js Image Optimization

Vercel shipped out-of-band patches for Next.js 16.4.1 and 15.5.28 fixing CVE-2026-96889, a use-after-free in librsvg reachable via the Image Optimization API that leads to unauthenticated remote code execution. All versions from 10.0.0 to 15.5.27 and 16.0.0 to 16.4.0 are affected; CVSS 9.5.

DEV Community

Open source

CVE-2026-96889: Critical RCE in Next.js Image Optimization

CVSS 9.5: RCE with no login and no user interaction
Affected: Next.js 10.0.0–15.5.27 and 16.0.0–16.4.0
Fixed in 15.5.28 and 16.4.1 via bundled sharp 0.35.5
Third image-pipeline RCE in Next.js since August

#Next.js#Vercel#Librsvg#Sharp

CVE-2026-94545: RCE in Next.js via next/og and Satori

Security

Critical Next.js ImageResponse flaw allows server code execution

Security

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws

Security

CVE-2026-96889: Critical RCE in Next.js Image Optimization

CVE-2026-94545: RCE in Next.js via next/og and Satori

Critical Next.js ImageResponse flaw allows server code execution

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws

Satori and Next.js SVG escaping flaw led to RCE risk