GHSA-2464-fhr4-w9xw in Next.js 16.1.1
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
- Severity
- Critical 9.5
- Exploitation
- No data
- Fix
- Update to 16.4.1
- Where
- App / API
- How it matched
- Exact version match
- First seen
- 2026-11-05 01:13:58 UTC
- Source
- https://osv.dev/vulnerability/GHSA-2464-fhr4-w9xw