{"id":"GHSA-vcvr-r3jv-pc5j","aliases":[],"url":"https://o3.security/vulnerability/GHSA-vcvr-r3jv-pc5j","summary":"Next.js: Remote Code Execution in next/og ImageResponse","details":"## Impact\n\nThe Node.js `ImageResponse` implementation from `next/og` is affected by an upstream vulnerability. This can lead to remote code execution.\n\nAffected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:\n\n```tsx\nimport { ImageResponse } from 'next/og'\n\nexport async function GET(request: Request) {\n  const value = new URL(request.url).searchParams.get('value') ?? ''\n\n  return new ImageResponse(\n    <svg width=\"1200\" height=\"630\">\n      <title>{value}</title>\n    </svg>\n  )\n}\n```\n\nApplications using the Edge `ImageResponse` implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.\n\n## Workaround\n\nIf upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js `ImageResponse` implementation from `next/og`.","published":"2026-09-30T14:48:30Z","modified":"2026-10-01T03:56:48.683494153Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"next","fixedVersion":"16.3.6"}],"fix":{"url":"https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e","label":"vercel/next.js@868fad3"},"references":[{"type":"WEB","url":"https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j"},{"type":"WEB","url":"https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp"},{"type":"WEB","url":"https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e"},{"type":"PACKAGE","url":"https://github.com/vercel/next.js"},{"type":"WEB","url":"https://github.com/vercel/next.js/releases/tag/v16.3.6"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-01T03:56:48.683494153Z"}}