A critical security flaw was recently identified in Next.js applications utilizing the Node.js implementation of ImageResponse from the next/og package. The vulnerability, known as GHSA-vcvr-r3jv-pc5j, potentially allows for remote code execution. This flaw impacts Next.js versions 16.2.0 through 16.3.5, and developers are urged to upgrade to version 16.3.6, which contains the necessary fixes.
Understanding the ImageResponse Vulnerability
The vulnerability becomes apparent when applications process attacker-controlled input into SVG content, attributes, or styles during dynamic image generation. ImageResponse is frequently employed to generate Open Graph images and social media previews, making it a common tool for developers. If an application integrates untrusted input into SVG elements without proper handling, it opens the door for crafted payloads to execute code remotely.
Technical Details and Affected Versions
According to the GitHub advisory, the risk is specific to the Node.js version of ImageResponse; applications using the Edge implementation remain unaffected. The core issue stems from Satori, the SVG generation library. Satori failed to correctly escape certain values, leading to their interpretation as SVG markup. This upstream problem, tracked as CVE-2026-94545 and GHSA-wx4j-mvgx-mqwp, affects Satori versions 0.0.27 through 0.33.4, with a fix available in version 0.33.5.
Mitigation and Urgent Recommendations
GitHub has rated the Next.js vulnerability as critical under the CVSS v4 scoring system, noting the potential for network-based exploitation with minimal attack complexity and no privilege requirements. Organizations should prioritize upgrading to Next.js version 16.3.6 to address the security gap. For those unable to update immediately, it’s crucial to ensure no attacker-controlled data influences SVG content. Input validation is recommended, although it may not suffice if untrusted strings are interpreted as markup. Additionally, developers should evaluate custom image-generation endpoints for security risks.
Switching to the Edge ImageResponse implementation can mitigate exposure, but thorough testing is advised to ensure compatibility. Security researchers RaghavMaheshwari124 and rafabd1 are credited with identifying this significant vulnerability, highlighting the pressing need for affected deployments to treat the update as a critical priority.
