CVE-2026-96889: Next.js Image Optimization RCE Vulnerability — Analysis & Mitigation

Originally published at https://faizanakhtarcyber.blogspot.com/2026/10/cve-2026-96889-nextjs-image-optimization-rce-analysis.html

On October 14, 2026, Vercel shipped an out-of-band security release for Next.js — versions 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS) — to fix CVE-2026-96889, a critical remote code execution vulnerability in the framework's Image Optimization API. A crafted SVG file processed by the image pipeline can corrupt server memory and escalate into arbitrary code execution, with no login and no user interaction. For the security of cyberspace, the scary part is the blast radius: Next.js powers millions of production sites, and the vulnerable range spans every release line from 10.0.0 onward.

Summary

CVE-2026-96889 is a use-after-free (CWE-416) flaw in librsvg, the SVG rendering library that Next.js reaches through its bundled sharp image-processing package. When the Image Optimization API (or next/og image generation) processes an SVG document containing nested XML inclusions (XIncludes) with duplicate entity declarations, the library frees an XML entity that the parser is still using. An attacker who slips a malicious SVG into that pipeline — via an optimized image URL or a social-image endpoint — can turn memory corruption into remote code execution on glibc-based Linux servers.

Two details make this one unusual. First, the underlying librsvg bug was public since September 23 and fixed in sharp 0.35.5 on September 27 — but Next.js shipped its fix only on October 14, a two-week lag. Second, this is the third image-processing code-execution flaw in Next.js since August: an August libheif bug reachable through crafted AVIF files, a September next/og SVG flaw, and now this librsvg use-after-free. The image pipeline has become the framework's most reliable source of critical vulnerabilities.

Vercel rates the Next.js exposure as CVSS 9.5 Critical — fully network-reachable, no privileges required — because the framework's image endpoint turns a local file-parsing bug into a remote one.

Severity

CVE ID: CVE-2026-96889 (GHSA-2464-fhr4-w9xw)
CVSS 4.0: 9.5 Critical — Vercel/Next.js advisory rating for the framework exposure
Underlying librsvg flaw: CVSS 3.1: 7.8 High (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) — Red Hat CNA scoring
Weakness: CWE-416 — Use After Free
Attack requirements: none — unauthenticated, remote, low complexity, no user interaction (per the Next.js advisory)
Impact: remote code execution on glibc-based Linux (Debian/Ubuntu containers); crash-only on some Node.js builds and musl-based (Alpine) images
Exploited in the wild: no confirmed reports as of October 15, 2026

Read the two scores as context: the library bug needs someone to open a malicious file; the framework exposure lets anyone on the internet be that someone.

Affected Versions

Next.js 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0 — the widest vulnerable range of any Next.js disclosure this year
Fixed in: 15.5.28 and 16.4.1
Underlying library: sharp before 0.35.5 (bundles librsvg before 2.63.2) — 16.4.1 fixes it purely by bumping the bundled sharp
Platform scope: code execution applies to Next.js on glibc-based Linux; Alpine/musl builds are not named as affected — confirm your base image before assuming safety
Reachability: apps with dangerouslyAllowSVG enabled in the Image Optimization config, and any app using next/og ImageResponse on the Node.js runtime

The sibling fixes in this release — a 9.5 use cache RCE and an 8.2 Server Actions DoS — have no workaround. But for the SVG flaw, sharp itself is the fix vector: getting bundled sharp to 0.35.5+ closes the hole.

Technical Analysis

The SVG That Fires Back: Anatomy of a Use-After-Free

A use-after-free (CWE-416) means the program releases a chunk of memory while a pointer to it is still live; later, attacker-influenced data gets written into that freed slot, and the stale pointer follows it somewhere the attacker chooses. In librsvg, the trigger is an SVG document with nested XML inclusions (XIncludes) carrying duplicate entity declarations — the XML parser frees an entity that is still referenced, and subsequent parsing operations reuse the dangling reference. Crafted carefully, that reuse corrupts heap metadata or function pointers, and in a Node.js server process, heap corruption is a short walk from arbitrary code execution.

Both end up calling sharp, which calls librsvg, which parses attacker-shaped XML — a parser never designed to face the internet, placed there by the framework anyway.

Pentest Perspective: Your Image Pipeline Is a Parser With Server Dreams

As a pentest target, the Next.js image optimizer is close to ideal for an attacker: it is unauthenticated by design, it performs complex parsing of attacker-controlled formats, and it runs inside the server process with the server's privileges. During a pen test, this is exactly the kind of endpoint I fingerprint first — /_next/image?url=... is a beacon announcing "here is a file parser you can reach from the internet."

The exploitation chain a tester would map looks like this: (1) confirm the app serves optimized images or next/og endpoints; (2) deliver an SVG with nested XIncludes and duplicate entities; (3) observe crashes or hangs to confirm memory corruption; (4) tune the heap layout toward control. Whether step 4 lands as code execution or a crash depends on the server's Node.js build — official Node binaries lack hardening against this memory-attack class. Hardened builds yield a reliable crash (a DoS primitive); soft builds yield a shell.

Three Strikes: Why Image Processing Keeps Breaking Next.js

August: libheif, reachable through crafted AVIF files. September: next/og, where attacker-controlled text altered the generated SVG. October: librsvg, through nested XIncludes. Three different libraries, one pattern — every image format is a parser, every parser is a state machine fed untrusted bytes, and Next.js keeps chaining new parsers into its hottest request path.

Your application's security now depends on an SVG library, bundled inside an image package, bundled inside a framework — three layers down. When the fix sits upstream for two weeks before your framework ships it, your patching SLA is the slowest layer's, not the fastest.

Why This Matters

Next.js is not a niche framework. It runs everything from startup landing pages to Fortune 500 storefronts, which means a remotely reachable image-parser RCE is effectively a skeleton key to a meaningful slice of the modern web.

What does vulnerable mean in the context of CVE-2026-96889? It means your image optimizer — a feature you probably think of as cosmetic — can turn a picture request into a server shell, with no login and no click. If your app exposes /_next/image or generates next/og cards on the Node runtime, assume you are in the blast radius until patched. How should a pentest scope treat image handling after CVE-2026-96889? Stop treating it as a frontend concern. It is a memory-unsafe parsing pipeline running inside your server process, and it deserves the same patching urgency as your authentication code.

Mitigation

Patch immediately: npm install [email protected] or npm install [email protected] — the sibling flaws have no workaround, so upgrade regardless
Targeted fix for the SVG flaw: ensure the sharp version used by Next.js is 0.35.5 or later (carries librsvg 2.63.2) — upgrading Next.js pulls this in automatically
No complete workaround for the release as a whole; for the SVG flaw specifically, disabling dangerouslyAllowSVG and auditing next/og usage reduces exposure but does not fix the library
Verify your base image: code execution is scoped to glibc-based Linux — confirm whether your containers are Debian/Ubuntu or musl-based Alpine rather than assuming
Hunt for exposure: check access logs for repeated /_next/image SVG requests since September 23, plus crashes or worker restarts in the image pipeline
Harden going forward: pin and audit transitive image-processing dependencies, and put the image pipeline inside your pen test scope on every engagement