Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

Next.js uses an upstream library called 'sharp' for image optimization. A memory-related vulnerability in this library can be exploited to achieve remote code execution without authentication when SVG files are processed on glibc-based Linux environments. The issue affects Next.js versions >=10.0.0 <15.5.28 and >=16.0.0 <16.4.1. Upgrading 'sharp' to version 0.35.5 or higher mitigates the vulnerability. Fresh installs of Next.js automatically include the fixed 'sharp' version. The vulnerability has a CVSS 4.0 vector indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation allows unauthenticated remote code execution on servers running vulnerable Next.js versions on glibc-based Linux. This can lead to full system compromise. There are no known exploits in the wild at this time.

Upgrade the 'sharp' library used by Next.js to version 0.35.5 or later. Upgrading Next.js to patched versions (>=15.5.28 and >=16.4.1) ensures that package managers automatically provide the fixed 'sharp' version. Fresh installs of Next.js also include the fixed version. No other workarounds are indicated.