Critical Remote Code Execution Vulnerability in Next.js Package
Summary
GHSA-vcvr-r3jv-pc5j: Next.js: Remote Code Execution in next/og ImageResponse. Affects next versions >= 16.2.0, < 16.3.6. Fixed in 16.3.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is a popular React framework that enables developers to build server-rendered applications with ease. It offers features like automatic code splitting, server-side rendering, and static site generation. However, a recent vulnerability in the Node.js ImageResponse implementation from the next/og module has raised concerns, as it allows for remote code execution when attacker-controlled values are passed into SVG content during image generation.
Vulnerability Detail
The vulnerability arises from the Node.js ImageResponse implementation in the next/og module, which is susceptible to an upstream issue. When applications pass user-controlled values into SVG content, attributes, or styles, it opens the door for remote code execution. This can lead to severe security risks, as attackers may exploit this flaw to execute arbitrary code on the server, potentially compromising sensitive data and application integrity.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
16.3.6
This is the first release that contains the fix.
npm install next@16.3.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, avoid passing attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation from next/og. For example, modify your code as follows to prevent user input from being directly included in the SVG:
import { ImageResponse } from 'next/og'
export async function GET(request: Request) {
const value = new URL(request.url).searchParams.get('value') ?? ''
const sanitizedValue = sanitize(value); // Implement a sanitization function
return new ImageResponse(
<svg width="1200" height="630">
<title>{sanitizedValue}</title>
</svg>
)
}
Conclusion
The identified vulnerability in the Next.js package poses a significant risk of remote code execution due to improper handling of user-controlled values in SVG content. It is crucial for developers to update to the patched version or implement workarounds to safeguard their applications against potential exploitation.
See every vulnerability recorded for next →
FAQ
The CVSS score of this vulnerability is 9.5, indicating a critical severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to run arbitrary code on your server, which may compromise sensitive data and application integrity.
Yes, you can mitigate the risk by ensuring that no attacker-controlled values are passed into SVG content, attributes, or styles in your application.
If immediate upgrading is not possible, implement input sanitization to ensure that any user-controlled values are properly sanitized before being included in SVG content.
References
Related vulnerabilities
Recent vulnerabilities recorded for next.
