p PatchFirst

GHSA-2464-fhr4-w9xw

GHSA-2464-fhr4-w9xw · Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

## Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. ## Workaround Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.

CVSS 9.5 · Crítica · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • next npm

    Intervalos de versiones afectados
    • SEMVER: ≥ 10.0.0, < 15.5.28

    Actualiza a 15.5.28

  • next npm

    Intervalos de versiones afectados
    • SEMVER: ≥ 16.0.0, < 16.4.1

    Actualiza a 16.4.1

Fuentes originales

Comprueba tu servidor →