Security incidents tagged sharp. Newest first.
On Oct 14 2026 Vercel shipped Next.js 16.4.1 and 15.5.28 with two critical unauthenticated remote code execution fixes held back from the September release: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a use-after-free in librsvg (via sharp) reachable through the Image Optimization API when SVGs are processed on glibc-based Linux, and GHSA-673q-mjm6-r5xr, RCE in App Router apps with Cache Components when a `use cache` function returns multiple typed arrays. A high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r) is fixed too. GitHub added the SVG advisory to its global database on Oct 22. No known exploitation.
Next.js (next on npm), sharp / librsvgSince Oct 14, 2026
‼️ ALERT - Next.js just shipped an out-of-band security update for TWO critical unauthenticated RCE flaws (both CVSS 9.5) + a high-severity DoS. RCEs: RSC use cache (GHSA-673q-mjm6-r5xr) and librsvg via sharp (CVE-2026-96889). 🔗 Read - t.co/ndnN46ysGv
🚨 CRITICAL: CVE-2026-96889 — Next.js Image Optimization RCE via SVG (librsvg/sharp) Score 9.5 (CVSS 4.0, Next.js advisory). Unauthenticated. Glibc Linux. Affects Next.js 10.0.0–15.5.27 and 16.0.0–16.4.0. Fixed in 15.5.28 and 16.4.1. Check npm ls sharp → 0.35.5+. Not in CISA
