CVE-2026-96889: Next.js Image Optimization RCE Vulnerability — Analysis & Mitigation
Originally published at https://faizanakhtarcyber.blogspot.com/2026/10/cve-2026-96889-nextjs-image-optimization-rce-analysis.html On October 14, 2026, Vercel shipped an out-of-band security release for Next.js — versions 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS) — to fix CVE-2026-96889 , a critical remote code execution vulnerability in the framework's Image Optimization API. A crafted…
On October 14, 2026, Vercel released an emergency security update for Next.js versions 16.4.1 and 15.5.28 to address CVE-2026-96889, a critical remote code execution vulnerability in the framework's Image Optimization API. The flaw allows an attacker to corrupt server memory, leading to arbitrary code execution, with no authentication required and no user interaction necessary.
Next.js powers millions of production sites, and the vulnerability affects every release from version 10.0.0 onward. This issue highlights a growing trend of image-processing code-execution flaws in the framework, with the underlying librsvg bug publicly known since September 23, 2026, but only patched by Next.js on October 14, two weeks later.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
