PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

VectorFreed: librsvg Use-After-Free (CVE-2026-96889) Leading to RCE in Next.js and Downstream Frameworks

github.com | vulnerability | Critical | CVE-2026-96889 | #rce | #supply-chain | #red-team | #exploitation | #uaf | #librsvg | #cve-2026-9688
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

# VectorFreed ## Abstract This document introduces "VectorFreed", a vulnerability chain that begins with a use-after-free I (@rafabd1) found in librsvg (CVE-2026-96889). In a Node.js/Sharp/libvips...

Why it matters

Demonstrates how an upstream native C library memory corruption bug in an image rendering stack (librsvg/libvips) propagates into widely used web frameworks, creating severe unauthenticated RCE attack vectors.
CVE
CVE-2026-96889
Vendor
GNOME / Vercel
Product
librsvg / Next.js
Affected versions
librsvg < 2.63.2; Next.js 16.2.0-16.3.5 / 10.0.0-15.5.27, 16.0.0-16.4.0
CVSS
9.5
Published
Collected

Related coverage

Critical · vulnerability · github.com
CVE-2026-111497: Unauthenticated WordPress RCE Exploit Chain PoC via Brotli Decoder Flaw
Demonstrates a reliable, real-world weaponization of the Brotli decoder memory corruption flaw in web application environments without requiring information leaks or debugging instrumentation. Highlights the critical risk of untrusted compressed streams in server-side HTTP clients.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
Critical · vulnerability · github.com
php2shell (CVE-2026-109618 / CVE-2026-109619): PHP Pre-Auth RCE PoC, Source Patch & Comprehensive Defense Guide
Provides critical stopgap mitigations, source-level patches, and multi-web-server WAF rules for teams securing PHP deployments, especially for unpatched legacy and end-of-life installations.
High · vulnerability · github.com
PHP 8.5.5: var_destroy __destruct Reentrancy Heap UAF and Exploitation
Demonstrates how subtle lock-free destructor reentry in complex serialization state machines can yield reliable memory corruption and RCE, even when explicit magic method dispatches are guarded.
Critical · vulnerability · aikido.dev
Node2Shell Evolves to HTTP2Shell: Google Brotli Flaw (CVE-2026-111497) Affects HTTP Ecosystem
Brotli is ubiquitous across the modern HTTP ecosystem for web asset compression. Because the flaw allows unauthenticated remote code execution in both directions, any service or client automatically decompressing untrusted Brotli payloads is at critical risk until patched.
tool · github.com
Brotli Client Checker: Test Server for Brotli Decoder Vulnerability (CVE-2026-111497)
Provides security teams and developers with a simple, zero-dependency mechanism to test whether backend microservices, crawlers, and HTTP clients are susceptible to the widespread Node2Shell/HTTP2Shell Brotli decoder flaw.
Back