{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-CB458054",
  "slug": "cve-2026-96889-nextjs-october-2026-security-update-rce",
  "title": "Next.js October 2026 security update: unauthenticated Image Optimization and use cache RCEs (CVE-2026-96889)",
  "aliases": [
    "CVE-2026-96889",
    "GHSA-2464-fhr4-w9xw",
    "GHSA-673q-mjm6-r5xr",
    "GHSA-p3m5-59mp-jv5r",
    "Next.js 16.4.1",
    "Next.js 15.5.28",
    "sharp 0.35.5"
  ],
  "summary": "On 2026-10-14 Vercel published Next.js advisories for two unauthenticated remote code execution bugs and a Server Actions denial of service. GHSA-2464-fhr4-w9xw (CVE-2026-96889) is an Image Optimization RCE when SVG is processed through sharp/librsvg on glibc Linux. GHSA-673q-mjm6-r5xr is an unauthenticated RCE in use cache functions that return typed arrays (Next.js 16 only). GHSA-p3m5-59mp-jv5r is a high-severity Server Actions DoS. Fixed in next 15.5.28 and 16.4.1, with sharp 0.35.5 required for the image path. On the 15.x line, next@15.5.28 still accepts sharp ^0.34.3 || ^0.35.5, so a lockfile that already resolved sharp 0.34 can keep the vulnerable decoder after upgrading Next.js.",
  "status": "published",
  "severity": "critical",
  "confidence": "high",
  "uncertainty": "No known exploitation in the wild as of publish. Vercel-hosted Image Optimization may differ from self-hosted sharp paths. macOS/Windows and musl builds are out of scope for the librsvg/glibc Image Optimization RCE per the advisory.",
  "firstObservedAt": "2026-10-14T17:46:00Z",
  "lastObservedAt": "2026-10-14T22:16:59Z",
  "publishedAt": "2026-10-14T22:27:42.230Z",
  "reviewedAt": "2026-10-14T22:27:38.430Z",
  "expiresAt": "2026-10-14T22:16:59Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "ghsa-2464",
      "label": "GHSA-2464-fhr4-w9xw Next.js Image Optimization RCE",
      "url": "https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-10-14T17:46:00Z"
    },
    {
      "id": "ghsa-673q",
      "label": "GHSA-673q-mjm6-r5xr Next.js use cache typed-array RCE",
      "url": "https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-10-14T17:47:00Z"
    },
    {
      "id": "ghsa-p3m5",
      "label": "GHSA-p3m5-59mp-jv5r Next.js Server Actions DoS",
      "url": "https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-10-14T17:47:00Z"
    },
    {
      "id": "ghsa-sharp",
      "label": "GHSA-wq5f-xc86-pv6w sharp/librsvg (CVE-2026-96889)",
      "url": "https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-09-30T19:22:00Z"
    },
    {
      "id": "blog",
      "label": "HOL Guard blog write-up",
      "url": "https://hol.org/blog/cve-2026-96889-nextjs-october-2026-security-update-rce",
      "sourceType": "other_primary",
      "observedAt": "2026-10-14T22:16:59Z"
    }
  ],
  "artifacts": [
    {
      "id": "art-next",
      "artifactClass": "package",
      "ecosystem": "npm",
      "name": "next",
      "version": ">=10.0.0 <=15.5.27; >=16.0.0 <=16.4.0",
      "defanged": false
    },
    {
      "id": "art-sharp",
      "artifactClass": "package",
      "ecosystem": "npm",
      "name": "sharp",
      "version": "<0.35.5",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "tl-sharp-fix",
      "occurredAt": "2026-09-27T00:00:00Z",
      "eventType": "vendor_action",
      "summary": "sharp 0.35.5 published with librsvg fix",
      "sourceIds": [
        "ghsa-sharp"
      ]
    },
    {
      "id": "tl-sharp-adv",
      "occurredAt": "2026-09-30T19:22:00Z",
      "eventType": "disclosure",
      "summary": "sharp GHSA-wq5f-xc86-pv6w published for CVE-2026-96889",
      "sourceIds": [
        "ghsa-sharp"
      ]
    },
    {
      "id": "tl-next",
      "occurredAt": "2026-10-14T17:46:00Z",
      "eventType": "disclosure",
      "summary": "Next.js GHSA-2464 / 673q / p3m5 published; fixed in 15.5.28 and 16.4.1",
      "sourceIds": [
        "ghsa-2464",
        "ghsa-673q",
        "ghsa-p3m5"
      ]
    },
    {
      "id": "tl-blog",
      "occurredAt": "2026-10-14T22:16:59Z",
      "eventType": "other",
      "summary": "HOL Guard practitioner blog published",
      "sourceIds": [
        "blog"
      ]
    }
  ],
  "coverage": [
    {
      "assertionId": "no-guard-pack",
      "relationship": "not_covered",
      "limitation": "No HOL Guard evidence pack in feed for CVE-2026-96889 at publish time; campaign tracks vendor advisories and blog analysis only."
    }
  ],
  "policies": [],
  "limitations": [
    "Image Optimization RCE via librsvg applies to glibc Linux self-hosted sharp paths when SVG is processed; macOS, Windows, and musl are out of scope per advisory.",
    "use cache typed-array RCE affects Next.js 16.x only.",
    "Not reported as exploited in the wild as of 2026-10-14."
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-96889-nextjs-october-2026-security-update-rce/corrections"
}