[yusuke-koyoshi]

Updates

• Affected products

Comments
Requesting withdrawal of this advisory (or removal of the next affected ranges).

The vulnerability is CVE-2026-96889 in librsvg (GHSA-cpvr-w4j5-2mpg), which reaches Next.js only through the optional dependency sharp. It is already tracked against sharp in GHSA-wq5f-xc86-pv6w (< 0.35.5). Next.js itself contains no vulnerable code: the referenced fix commits (5e3b687, 9571ec8) only change the sharp range in optionalDependencies.

The next version does not determine exposure, so the ranges on this advisory produce both false positives and false negatives:

• next 15.5.28 (listed as patched) declares "sharp": "^0.34.3 || ^0.35.5", which still allows the vulnerable sharp 0.34.x. A lockfile that pins sharp 0.34.x stays vulnerable after upgrading next.
• next 15.5.27 (listed as affected) declares "sharp": "^0.34.3 || ^0.35.4", so a fresh install resolves sharp 0.35.5, which is not vulnerable. The advisory itself says "Fresh installs automatically get a fixed version of sharp".
• next 10.0.0 through 14.x do not depend on sharp at all (for example, v14.2.30 has no sharp entry in packages/next/package.json; sharp first appears in optionalDependencies in v15.0.0). Users who install sharp themselves are already covered by GHSA-wq5f-xc86-pv6w.

Scanners that resolve the dependency tree already flag the vulnerable sharp through GHSA-wq5f-xc86-pv6w. Flagging next on top of that duplicates the alert and points users at the wrong package to upgrade.

References:
https://github.com/vercel/next.js/blob/v15.5.28/packages/next/package.json
https://github.com/vercel/next.js/blob/v14.2.30/packages/next/package.json
GHSA-wq5f-xc86-pv6w

[github]

Hi there @eps1lon! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[yusuke-koyoshi]

The empty package entry ("name": "", introduced: "0") is only there because the improvement form requires at least one affected product. It is not a proposed value. The intent is to withdraw this advisory, or failing that, to remove the next ranges, as explained in the description above.