critical severityConfidence highHistorical record

Next.js October 2026 security update: unauthenticated Image Optimization and use cache RCEs (CVE-2026-96889)

On 2026-10-14 Vercel published Next.js advisories for two unauthenticated remote code execution bugs and a Server Actions denial of service. GHSA-2464-fhr4-w9xw (CVE-2026-96889) is an Image Optimization RCE when SVG is processed through sharp/librsvg on glibc Linux. GHSA-673q-mjm6-r5xr is an unauthenticated RCE in use cache functions that return typed arrays (Next.js 16 only). GHSA-p3m5-59mp-jv5r is a high-severity Server Actions DoS. Fixed in next 15.5.28 and 16.4.1, with sharp 0.35.5 required for the image path. On the 15.x line, [email protected] still accepts sharp ^0.34.3 || ^0.35.5, so a lockfile that already resolved sharp 0.34 can keep the vulnerable decoder after upgrading Next.js.

Also tracked as CVE-2026-96889 · GHSA-2464-fhr4-w9xw · GHSA-673q-mjm6-r5xr · GHSA-p3m5-59mp-jv5r · Next.js 16.4.1 · Next.js 15.5.28 · sharp 0.35.5

First observed
Oct 14, 2026
Last observed
Oct 14, 2026
Last reviewed
Oct 14, 2026
Tracking ended
Oct 14, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

No known exploitation in the wild as of publish. Vercel-hosted Image Optimization may differ from self-hosted sharp paths. macOS/Windows and musl builds are out of scope for the librsvg/glibc Image Optimization RCE per the advisory.

  • Image Optimization RCE via librsvg applies to glibc Linux self-hosted sharp paths when SVG is processed; macOS, Windows, and musl are out of scope per advisory.
  • use cache typed-array RCE affects Next.js 16.x only.
  • Not reported as exploited in the wild as of 2026-10-14.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

  • not covered

    No HOL Guard evidence pack in feed for CVE-2026-96889 at publish time; campaign tracks vendor advisories and blog analysis only.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Vendor action

    sharp 0.35.5 published with librsvg fix

  2. Disclosure

    sharp GHSA-wq5f-xc86-pv6w published for CVE-2026-96889

  3. Disclosure

    Next.js GHSA-2464 / 673q / p3m5 published; fixed in 15.5.28 and 16.4.1

  4. Update

    HOL Guard practitioner blog published

Publication clock: 339.1 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; historical backfill outside target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • next@>=10.0.0 <=15.5.27; >=16.0.0 <=16.4.0npmpackage
  • sharp@<0.35.5npmpackage

Sources

Every claim on this record is traceable to the sources below.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-CB458054