{"type":"bundle","id":"bundle--3fa9b871-2607-5d7b-a912-3d7e31420b17","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--37879b14-72ff-5b5c-a716-15a70e44e2ec","created":"2026-10-14T22:27:42.230Z","modified":"2026-10-14T22:27:42.230Z","name":"Next.js October 2026 security update: unauthenticated Image Optimization and use cache RCEs (CVE-2026-96889)","description":"On 2026-10-14 Vercel published Next.js advisories for two unauthenticated remote code execution bugs and a Server Actions denial of service. GHSA-2464-fhr4-w9xw (CVE-2026-96889) is an Image Optimization RCE when SVG is processed through sharp/librsvg on glibc Linux. GHSA-673q-mjm6-r5xr is an unauthenticated RCE in use cache functions that return typed arrays (Next.js 16 only). GHSA-p3m5-59mp-jv5r is a high-severity Server Actions DoS. Fixed in next 15.5.28 and 16.4.1, with sharp 0.35.5 required for the image path. On the 15.x line, next@15.5.28 still accepts sharp ^0.34.3 || ^0.35.5, so a lockfile that already resolved sharp 0.34 can keep the vulnerable decoder after upgrading Next.js.","aliases":["CVE-2026-96889","GHSA-2464-fhr4-w9xw","GHSA-673q-mjm6-r5xr","GHSA-p3m5-59mp-jv5r","Next.js 16.4.1","Next.js 15.5.28","sharp 0.35.5"],"first_seen":"2026-10-14T17:46:00Z","last_seen":"2026-10-14T22:16:59Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"GHSA-2464-fhr4-w9xw Next.js Image Optimization RCE","url":"https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw"},{"source_name":"GHSA-673q-mjm6-r5xr Next.js use cache typed-array RCE","url":"https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr"},{"source_name":"GHSA-p3m5-59mp-jv5r Next.js Server Actions DoS","url":"https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r"},{"source_name":"GHSA-wq5f-xc86-pv6w sharp/librsvg (CVE-2026-96889)","url":"https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w"},{"source_name":"HOL Guard blog write-up","url":"https://hol.org/blog/cve-2026-96889-nextjs-october-2026-security-update-rce"}]}]}