GHSA-2464-fhr4-w9xw: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

The advisory is brief. It says a memory-related vulnerability in an upstream library used for Image Optimization can lead to remote code execution when Next.js runs on glibc-based Linux. The title ties it to SVG files. The page names sharp only in the workaround and does not give the trigger or the memory-corruption mechanism. Do not assume more than that.

The CVSS 4.0 vector is network, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability, and the attack-requirements element marks a deployment precondition. Practically, an attacker who can make your Next.js server process a crafted image through the image optimizer could run code in the server process. That gives access to environment variables, database credentials, API keys and the host the process runs on.

The advisory does not say whether non-glibc Linux, macOS or Windows are affected. Self-hosted Next.js on common glibc distributions such as Debian and Ubuntu, and Docker images based on them, are the stated risk.

next from 10.0.0 through 15.5.27, and from 16.0.0 through 16.4.0, on glibc-based Linux. Check the Next.js version and the sharp version it resolves:

npm ls next sharp

The fixed sharp is 0.35.5 or later. The advisory's text for the second range reads "> 16.0.0" in one place; the package data uses 16.0.0 and up. To find your libc, run ldd --version in the runtime image: glibc prints GNU libc, and musl-based images such as Alpine differ.

Upgrade Next.js to 15.5.28 (15.x line) or 16.4.1 (16.x line):

npm install [email protected]

A patched Next.js makes package managers supply a fixed sharp. Alternatively, make sure the sharp Next.js uses is at least 0.35.5; fresh installs get a fixed version automatically, but a lockfile can pin an old one, so refresh it and rebuild. Redeploy the image, then confirm with npm ls sharp. The advisory lists no other workaround.

The advisory lists no indicators. Review logs for unusual requests to the /_next/image endpoint, especially with SVG sources or from unfamiliar clients, along with crashes or restarts of the Node process and out-of-memory or segmentation fault messages. Check for unexpected child processes, outbound connections or new files on hosts that serve the optimizer.

Impact

A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.

Workaround

Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.