PkgSeer

Vulnerability GHSA-2464-fhr4-w9xw

Critical

12 days ago

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

10.0.0 - 15.5.27 and 16.0.0 - 16.4.0

Summary

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

Details

Impact

A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.

Workaround

Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

16.0.0 - 16.4.0 GHSA-673q-mjm6-r5xr

next.js cache leak across root param values in nested 'use cache' functions

16.3.0 - 16.3.7 GHSA-h694-7cp9-m8p3

Next.js: Denial of Service in App Router using Server Actions

13.0.0 - 15.5.27 and 16.0.0 - 16.4.0 GHSA-p3m5-59mp-jv5r

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

16.3.0 - 16.3.7 GHSA-3w37-wq28-93x7

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

15.0.0 - 15.5.26 and 16.0.0 - 16.3.7 GHSA-4jqv-mc3x-m676

View all vulnerabilities for these packages

Impacted packages

next

Timeline

Published

12 days ago

Fixed (15.5.28)

20 days ago

Fixed (16.4.1)

Unknown

Last Modified

12 days ago