Critical Severity
CVE-2026-96889
Published: Oct 25, 2026
Lab PoC for CVE-2026-96889: Next.js Image Optimization SVG typed as AVIF reaches librsvg UAF (RUSTSEC-2026-0305). Unauthenticated RCE on glibc Linux.
# CVE-2026-96889 — Image Optimization SVG → librsvg use-after-free
Lab proof of concept for unauthenticated RCE (or DoS) through Next.js
`/_next/image` on glibc Linux. Run it only against systems you own.
A document that starts `<!--ftypavif-->` is a legal SVG, but Next's magic
sniffer types it as `image/avif`. AVIF is not in `BYPASS_TYPES`, so the buffer
reaches sharp → libvips → librsvg. librsvg then frees an `xmlEntity` that
libxml2 is still using (`RUSTSEC-2026-0305`).
Usable for RCE on official non-PIE node **v24.20.0** and **v22.23.3** (same
chain, different addresses). node v20.20.2 is DoS only (SIGSEGV).
sharp **0.35.5** (librsvg 2.63.2) is immune.
| | |
|---|---|
| GHSA | [GHSA-2464-fhr4-w9xw](https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw) |
| CVE | CVE-2026-96889 |
| Severity | Critical, CVSS 9.5 |
| Affected | `next` `>= 10.0.0 <= 15.5.27`, `> 16.0.0 <= 16.4.0` |
| Fixed | `next` **15.5.28** / **16.4.1** (pins `sharp >= 0.35.5`) |
| Platform | glibc Linux |
| Workaround | `sharp >= 0.35.5`. `images.unoptimized: true` also removes the surface. |
The 16.4.1 / 15.5.28 patches do **not** change content-type sniffing. A
deployment that upgraded Next but left `sharp` at 0.35.4 is still vulnerable.
Check the decoder (`sharp.versions` / `/sharpinfo`), not the Next version string.
## Supported / tested
**Supported** is the vendor advisory: `next >= 10.0.0 <= 15.5.27` and
`> 16.0.0 <= 16.4.0`, glibc Linux, `sharp < 0.35.5`. **Tested** is what
this repo actually ran.
| | Version | This lab |
|---|---|---|
| next | **16.4.0** + sharp 0.35.4 | UAF probe + RCE (`app/`) |
| next | **15.5.27** + sharp 0.35.4 | same `rce.svg`, no padding change (`app15/`) |
| next | **16.4.1** + sharp 0.35.5 | fixed (payload rasterizes) |
| next | **16.4.1** + sharp 0.35.4 | vulnerable again (sniffing unchanged) |
| next | 15.5.28 (stock) | vendor pin `sharp >= 0.35.5`; patched HTTP run is 16.4.1 |
| next | 10.0.0 – 15.5.26 | advisory range, not re-run