Next.js: Remote Code Execution in next/og ImageResponse

What it is

The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution.

Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:

Applications using the Edge ImageResponse implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.

How to check

1. Affected: next (npm) >= 16.2.0, < 16.3.6.
2. Compare your installed version with the range above (command below).

How to fix

1. Upgrade next to 16.3.6 or later.

npm ls next

Sources

• GitHub Security Advisory GHSA-vcvr-r3jv-pc5j ↗