UpHeron
All vulnerabilities

npm

GHSA-2464-fhr4-w9xw

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

Severity
Critical
Published
22 Oct 2026
Last changed
22 Oct 2026
Added to UpHeron
23 Oct 2026
Fixed in
15.5.28, 16.4.1
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
Next.jsnpm · osv:npm:next
  • From 10.0.0 before 15.5.28
  • From 16.0.0 before 16.4.1

References