Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
Next.js next/og ImageResponse can let attackers run code
published 19 days ago
Summary
The ImageResponse feature in Next.js’s next/og module can execute malicious code if it processes SVG data that includes values supplied by users. This affects apps that embed user‑controlled text, attributes or styles into generated images. Update to a patched version or stop passing any user‑provided content into the SVG used by ImageResponse until you can upgrade.
What to do
- Update GitHub Actions next to version 16.3.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | next |
>= 16.2.0, < 16.3.6 Fix: upgrade to 16.3.6
|
Original advisory text
Next.js: Remote Code Execution in next/og ImageResponse
## Impact
The Node.js `ImageResponse` implementation from `next/og` is affected by an upstream vulnerability. This can lead to remote code execution.
Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:
```tsx
import { ImageResponse } from 'next/og'
export async function GET(request: Request) {
const value = new URL(request.url).searchParams.get('value') ?? ''
return new ImageResponse(
<svg width="1200" height="630">
<title>{value}</title>
</svg>
)
}
```
Applications using the Edge `ImageResponse` implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.
## Workaround
If upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js `ImageResponse` implementation from `next/og`.
The Node.js `ImageResponse` implementation from `next/og` is affected by an upstream vulnerability. This can lead to remote code execution.
Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:
```tsx
import { ImageResponse } from 'next/og'
export async function GET(request: Request) {
const value = new URL(request.url).searchParams.get('value') ?? ''
return new ImageResponse(
<svg width="1200" height="630">
<title>{value}</title>
</svg>
)
}
```
Applications using the Edge `ImageResponse` implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.
## Workaround
If upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js `ImageResponse` implementation from `next/og`.
References
- https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j URL
- https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp URL
- https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838... URL
- https://github.com/vercel/next.js Product
- https://github.com/vercel/next.js/releases/tag/v16.3.6 URL
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-1395Dependency on Vulnerable Third-Party Component
Timeline
Published30 Sep 2026
Updated1 Oct 2026
First seen1 Oct 2026
Sources
GHSA-vcvr-r3jv-pc5j · OSV
Track software like this
Free during beta