GHSA-2464-fhr4-w9xw

About vulnerability

Impact

A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.

Workaround

Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.

Affected product:

Next.js , React , arcjet-js , auth0-nextjs-auth0 , aws-amplify-adapter-nextjs , braintrust-openai-agents , braintrust-otel , braintrust-sdk-javascript , braintrust-temporal , bufbuild/connect-es , clerk-nextjs , connect-es , expo-next-adapter , fumadocs , fumadocs-ui , geist , hindsight , instantsearch , jovidecroock-prefresh , json-render-next , ledger-live , lit-labs-nextjs , mastra-braintrust , module-federation-nextjs-mf , mui-docs , mui-material-nextjs , mysten-docs , nx , nx-next , orama-orama , pigment-css , sanity-next-loader , scalar-nextjs-api-reference , scalar-nextjs-openapi , sentry-nextjs , solana-wallet-adapter-example , storybook-experimental-nextjs-vite , storybook-nextjs , storybook-nextjs-vite , tanstack-react-query-next-experimental , trpc-client , trpc-next , trpc-server , visual-editing , vite-plugin-storybook-nextjs , wyw-in-js , x402-next

Affected packages:

eslint-config-next @ 12.3.7 (+829 more)