GHSA-2464-fhr4-w9xw
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.
- No known exploitation
- Severity
- Critical, CVSS 9.5 (v4.0)
- Affected packages
- next (npm) >= 10.0.0, <= 15.5.27, fixed in 15.5.28 · GHSA-2464-fhr4-w9xw
- next (npm) >= 16.0.0, <= 16.4.0, fixed in 16.4.1 · GHSA-2464-fhr4-w9xw