GHSA-2464-fhr4-w9xw: Npm/next vulnerability
Impact
A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.
Workaround
Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 15.5.28 - Upgrade
Upgrade
sharpto a version that resolves this vulnerability.Fixed in 0.35.5
Event History
Frequently Asked Questions
Which deployments are exposed to possible remote code execution?
The issue affects Next.js deployments running on glibc-based Linux where Image Optimization uses a vulnerable upstream library version. Fresh installs automatically receive a fixed sharp version.
What is required to mitigate the issue if Next.js cannot be upgraded immediately?
Ensure that the version of sharp used by Next.js is 0.35.5 or later. Upgrading Next.js to a patched version also causes package managers to provide a fixed sharp version.