CVE-2026-96889: Next.js Image Optimization RCE Vulnerability — Analysis & Mitigation
On October 14, 2026, Vercel shipped an out-of-band security release for Next.js — versions 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS) — to fix CVE-2026-96889 , a critical remote code execution vulnerability in the framework's Image Optimization API. A crafted SVG file processed by the image pipeline can corrupt server memory and escalate into arbitrary code execution, with no login and no user interaction. For the security of cyberspace , the scary part is the blast radius: Next.js powers millions of production sites, and the vulnerable range spans every release line from 10.0.0 onward. Summary CVE-2026-96889 is a use-after-free (CWE-416) flaw in librsvg , the SVG rendering library that Next.js reaches through its bundled sharp image-processing package. When the Image Optimization API (or next/og image generation) processes an SVG document containing nested XML inclusions (XIncludes) with duplicate entity declarations, the library frees an XML entity that the pars...