Next.js SVG RCE (CVE-2026-96889): unauthenticated code execution through the Image Optimization API
A crafted SVG resized by /_next/image can run code in the Next.js server process on glibc-based Linux. SVG optimization is off by default, so exposure is narrow. Upgrade to 15.5.28 or 16.4.1, then confirm whether any app turned SVG on.
SEVERITY
Critical
PEAK CVSS
9.5
AUTH REQUIRED
None
PUBLIC POC
Not confirmed
PUBLISHED
Oct 28, 2026
REVISION
v1.0 · @Melly
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is tracking a critical, unauthenticated remote code execution flaw in the Next.js Image Optimization API. It is serious but conditional: only apps that enabled SVG optimization on glibc-based Linux are exposed. Upgrade every Next.js app, and treat any app with dangerouslyAllowSVG as an immediate priority.
KEY JUDGMENTS
01
No exploitation of CVE-2026-96889 had been confirmed as of Oct 28, 2026.Observed
02
Real-world exposure is narrow. All four conditions must hold, and SVG optimization is off by default, so most Next.js apps are not exposed.Assessed
03
Server-side image processing is a recurring attack surface: this is the second critical Next.js image-pipeline RCE in two months.Assessed
04
The Node.js runtime under every Next.js app is separately exposed to Brotli2Shell (CVE-2026-111497), which CISA added to KEV on Oct 27. Patch both in the same change window.Observed
Use-after-free in librsvg on SVG XML with duplicated entities
Affected
Next.js 10.0.0 to 16.4.0 (fixed in 15.5.28, 16.4.1)
Scoring
9.5 · CVSS v4.0
Preconditions
dangerouslyAllowSVG enabled (off by default), glibc-based Linux, attacker-controlled SVG
Impact
Remote code execution in the Node.js server process. No authentication.
EXPOSURE REQUIRES ALL FOUR CONDITIONS
01Affected Next.js versionBelow 15.5.28 or 16.4.1.
02SVG optimization ondangerouslyAllowSVG is set. Off by default.
03glibc-based LinuxAlpine (musl) is not affected.
04Attacker-controlled SVGVia an allowed remote domain or user uploads.
03 · THREAT ACTIVITY
Exploitation status and timeline
IN THE WILDNot confirmedNo exploitation confirmed as of Oct 28.
PUBLIC POCNot confirmedNo public proof-of-concept in vendor guidance.
PATCHAvailable15.5.28 and 16.4.1 released Oct 14.
DEFAULT CONFIGNot exposedSVG optimization is off unless enabled.
DISCLOSURE AND ACTIVITY TIMELINE · 2026
Aug 25Next.js discloses an earlier RCE in the same image pipeline, triggered by AVIF files, plus a Windows-only RCE (CVE-2026-75604).
Oct 14Next.js releases 15.5.28 and 16.4.1, fixing CVE-2026-96889, a use cache RCE in Next.js 16 and a Server Actions denial of service.
Oct 21Node.js ships fixes for Brotli2Shell, which affects the runtime under every Next.js app.
Oct 27CISA adds Brotli2Shell to KEV. CVE-2026-96889 has no confirmed exploitation.
04 · AFFECTED PRODUCTS
Affected and fixed versions
Version alone does not establish exposure. An affected version is in scope only when SVG optimization is enabled, the server runs on glibc-based Linux, and an attacker can supply the SVG.
PRODUCT
AFFECTED
FIXED IN
STATUS
Next.js 16.x
16.0.0 to 16.4.0
16.4.1
Fixed
Next.js 15.x
before 15.5.28
15.5.28
Fixed
Next.js 14.x and older
10.0.0 and later
None. Move to 15.5.28+
No fix
System librsvg
distribution-specific
Distribution security update
Fixed
Alpine / musl images
not affected
n/a
Not affected
HOSTINGNetlify states sites on its platform can be reached through next/og when the other conditions are met. Check your host's bulletin.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
Apps with dangerouslyAllowSVG onUpgrade to 15.5.28 or 16.4.1, or turn SVG optimization off until you can.
Next.js 14.x and olderPlan migration to a fixed line. No fix is announced for older majors.
HighWithin 72 hours
All Next.js 15 and 16 appsUpgrade, rebuild, redeploy. 16.4.1 also fixes the use cache RCE.
Images using system librsvgInstall your distribution's security update.
Node.js runtimePatch for Brotli2Shell in the same change window.
HighBefore closing
Every remediated appConfirm the production build runs the fixed version and record the config check as evidence.
WORKAROUNDS
Turn SVG optimization off. Remove dangerouslyAllowSVG or set it to false in next.config.Skip the server pipeline. Use the unoptimized prop on SVG images.Block at the edge. Block SVG requests to /_next/image at your CDN or WAF.Narrow remote image domains. Allow only domains you control.
06 · DETECTION AND HUNTING
Observables and hunting queries
No file hashes, payload samples or network indicators are published with this advisory. Hunt on exposure and request patterns.
TYPE
OBSERVABLE
SOURCE
Request
GET /_next/image?url=… ending in .svg
Web server, CDN or WAF access logs
Exposure
dangerouslyAllowSVG: true in next.config
Source repositories
Exposure
Next.js below 15.5.28 or 16.4.1 in the production build
Build output, npm ls next
HUNT · CVE-2026-96889SVG requests to the optimizer
Command and Scripting Interpreter (post-exploitation)
Theoretical
08 · TECHNICAL ANALYSIS
Root cause and attack path
The Image Optimization API resizes and converts images on the server through /_next/image. It passes images to sharp, which uses libvips. For SVG files, libvips calls librsvg to render the vector image into pixels. Red Hat describes the librsvg bug as a use-after-free that occurs when an SVG's XML includes duplicated entities. A crafted SVG can trigger it inside the Node.js process that serves the app.
Next.js disables SVG optimization by default because SVG files can carry scripts, which is why the setting is named dangerouslyAllowSVG. Alpine images use musl and are not affected.
Windows-only Next.js RCE, disclosed Aug 25. Score not confirmed.
AssessedThis is the second critical image-pipeline RCE in Next.js in two months. Server-side image processing is now a recurring attack surface.
09 · VALIDATION
Confirm remediation
A bumped package.json is not a verdict. Each app should end with evidence: fixed version in the production build, SVG optimization off, or a runtime that is not glibc-based.
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Is every Next.js app affected?
No. SVG optimization is off by default, and the flaw requires glibc-based Linux and an attacker-controlled SVG.
Which versions fix CVE-2026-96889?
Next.js 15.5.28 and 16.4.1. No fix is announced for 14.x and older.
Is CVE-2026-96889 being exploited?
No exploitation had been confirmed as of Oct 28, 2026.
Is there a workaround?
Turn off dangerouslyAllowSVG, serve SVGs with the unoptimized prop, or block SVG requests to /_next/image at the edge.
VALIDATE YOUR EXPOSURE
Prove your real Next.js exposure
Hayrok maps your Next.js apps, checks which image endpoints are reachable, and tests whether your controls block the attack and your SOC sees it. Every result lands in Evidence Fabric.