---
title: Tip: after the Next.js RCE fix, confirm the sharp version you actually ship | ctxsec
url: https://ctxsec.com/items/tip-nextjs-sharp-check
description: ""
status: "how-to"
published: 2026-10-15
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-nextjs-sharp-check.md)

how-to

2026-10-15

### Tip: after the Next.js RCE fix, confirm the sharp version you actually ship

Upgrade to Next.js 16.4.1 or 15.5.28, then check the lockfile and the built image, not just package.json: run `npm ls sharp` (or `pnpm why sharp`) and confirm 0.35.5 or later. The Next.js team says the fixed releases pull a fixed sharp, and its stated workaround if you can't upgrade yet is forcing sharp 0.35.5+. The SVG image-optimization RCE applies when Next.js runs on glibc-based Linux (for example Debian or Ubuntu base images, not Alpine/musl), so self-hosted containers deserve the closest look. The separate `use cache` RCE has no workaround, so upgrade anyway.

Sources: [Next.js security update (Oct 14)](https://nextjs.org/blog/nextjs-security-update-october-14-2026) · [sharp GHSA-wq5f-xc86-pv6w](https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w)