Upgrade to Next.js 16.4.1 or 15.5.28, then check the lockfile and the built image, not just package.json: run npm ls sharp (or pnpm why sharp) and confirm 0.35.5 or later. The Next.js team says the fixed releases pull a fixed sharp, and its stated workaround if you can't upgrade yet is forcing sharp 0.35.5+. The SVG image-optimization RCE applies when Next.js runs on glibc-based Linux (for example Debian or Ubuntu base images, not Alpine/musl), so self-hosted containers deserve the closest look. The separate use cache RCE has no workaround, so upgrade anyway.