Next.js: two ways to run code on the server without logging in (October 2026)
Identifiers: GHSA-2464-fhr4-w9xw · CVE-2026-96889 · GHSA-673q-mjm6-r5xr · CVSS 4.0 9.5 (scored by GitHub)
What it is
Next.js resizes images for you at /_next/image. A memory bug in the SVG library behind it lets an attacker who gets a crafted SVG processed run code on a server on glibc-based Linux. A second, separate bug lets anyone run code on apps that use the App Router with Cache Components when a 'use cache' function returns typed arrays; Vercel asks every 16.x app to upgrade, whether or not it has such a function.
Who is affected
Versions inside these ranges are affected. The fixed versions are the ones to move to.
| Registry | Package | Affected | Move to |
|---|---|---|---|
| npm | next | >= 10.0.0, <= 15.5.27 >= 16.0.0, <= 16.4.0 | 15.5.28, 16.4.1 |
How to check
Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:
d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" depsdocker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'xsec depsOr look up next in your lockfile and compare the version with the ranges above.
How to fix it
Upgrade next to 15.5.28 (15.x) or 16.4.1 (16.x); there is no 16.3.x backport. Upgrading next also gives it a fixed sharp; if you cannot upgrade yet, make sure the sharp that Next.js uses is 0.35.5 or later (that only covers the image bug).
Sources
This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.