---
id: 9945
title: "VectorFreed: librsvg Use-After-Free (CVE-2026-96889) Leading to RCE in Next.js and Downstream Frameworks"
cve: CVE-2026-96889
cvss: 9.5
severity: critical
vendor: "GNOME / Vercel"
product: "librsvg / Next.js"
affected_versions: "librsvg < 2.63.2; Next.js 16.2.0-16.3.5 / 10.0.0-15.5.27, 16.0.0-16.4.0"
source_domain: github.com
source_url: "https://github.com/rafabd1/VectorFreed"
published_at: "2026-09-24T06:35:15Z"
tags: ["rce", "supply-chain", "red-team", "exploitation", "uaf", "librsvg", "cve-2026-9688"]
phying_url: "https://phying.com/item/9945"
lang: en
---

# VectorFreed: librsvg Use-After-Free (CVE-2026-96889) Leading to RCE in Next.js and Downstream Frameworks

## Summary

# VectorFreed ## Abstract This document introduces "VectorFreed", a vulnerability chain that begins with a use-after-free I (@rafabd1) found in librsvg (CVE-2026-96889). In a Node.js/Sharp/libvips...

## Why it matters

Demonstrates how an upstream native C library memory corruption bug in an image rendering stack (librsvg/libvips) propagates into widely used web frameworks, creating severe unauthenticated RCE attack vectors.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-96889
- **CVSS:** 9.5
- **Vendor:** GNOME / Vercel
- **Product:** librsvg / Next.js
- **Affected versions:** librsvg < 2.63.2; Next.js 16.2.0-16.3.5 / 10.0.0-15.5.27, 16.0.0-16.4.0
- **Published:** 2026-09-24T06:35:15Z
- **Original:** https://github.com/rafabd1/VectorFreed
- **Phying News:** https://phying.com/item/9945