https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-30T09:48:45.890863+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/ghsa-2464-fhr4-w9xw GHSA-2464-fhr4-w9xw — Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used 2026-10-30T09:48:45.905038+00:00

Affected: npm: next

## Impact

A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.

## Workaround

Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.