criticalnextGHSA-2464-fhr4-w9xw
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
Affected versions
>= 10.0.0, <= 15.5.27, fixed in 15.5.28>= 16.0.0, <= 16.4.0, fixed in 16.4.1
Published 2026-10-22. Last checked 2026-11-01. Read the source advisory