{"id":"GHSA-vcvr-r3jv-pc5j","summary":"Next.js: Remote Code Execution in next/og ImageResponse","details":"## Impact\n\nThe Node.js `ImageResponse` implementation from `next/og` is affected by an upstream vulnerability. This can lead to remote code execution.\n\nAffected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:\n\n```tsx\nimport { ImageResponse } from 'next/og'\n\nexport async function GET(request: Request) {\n  const value = new URL(request.url).searchParams.get('value') ?? ''\n\n  return new ImageResponse(\n    \u003csvg width=\"1200\" height=\"630\"\u003e\n      \u003ctitle\u003e{value}\u003c/title\u003e\n    \u003c/svg\u003e\n  )\n}\n```\n\nApplications using the Edge `ImageResponse` implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.\n\n## Workaround\n\nIf upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js `ImageResponse` implementation from `next/og`.","modified":"2026-10-01T03:56:48.683494153Z","published":"2026-09-30T14:48:30Z","related":["CVE-2026-94545"],"database_specific":{"github_reviewed_at":"2026-09-30T14:48:30Z","nvd_published_at":null,"cwe_ids":["CWE-1395"],"severity":"CRITICAL","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j"},{"type":"WEB","url":"https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp"},{"type":"WEB","url":"https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e"},{"type":"PACKAGE","url":"https://github.com/vercel/next.js"},{"type":"WEB","url":"https://github.com/vercel/next.js/releases/tag/v16.3.6"}],"affected":[{"package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"16.2.0"},{"fixed":"16.3.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vcvr-r3jv-pc5j/GHSA-vcvr-r3jv-pc5j.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}]}