CVE-2026-119347

On self-hosted deployments, the Next.js image optimizer /next/image can be made to process an attacker-supplied SVG even when SVG support is disabled with dangerouslyAllowSVG: false the default. This reaches an SVG parser the application intended to keep disabled, increasing exposure to denial of...