GHSA-vcvr-r3jv-pc5j Next.js: Remote Code Execution in next/og ImageResponse
Remote code execution in Next.js ImageResponse allows attackers to execute arbitrary code via crafted SVG inputs in Node.js environments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-vcvr-r3jv-pc5j?
GHSA-vcvr-r3jv-pc5j is a code injection vulnerability in next, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution.
Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:
import { ImageResponse } from 'next/og'
export async function GET(request: Request) {
const value = new URL(request.url).searchParams.get('value') ?? ''
return new ImageResponse(
<svg width="1200" height="630">
<title>{value}</title>
</svg>
)
}
Applications using the Edge ImageResponse implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.
Workaround
If upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation from next/og.
Which versions are affected by GHSA-vcvr-r3jv-pc5j?
2 open source packages ship an affected version, including next.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 16.2.0 | 16.3.6 |
next npm | From 16.2.0 | 16.3.6 |
How do I fix GHSA-vcvr-r3jv-pc5j?
Upgrade next to 16.3.6 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-vcvr-r3jv-pc5j being exploited?
There is no known exploitation of GHSA-vcvr-r3jv-pc5j in the wild and no public exploit code.