Security Digest · Critical advisory (no CVE assigned)
GHSA-vcvr-r3jv-pc5j: Next.js: Remote Code Execution in next/og ImageResponse
Impact The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability.
CVSS 9.5 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
npm audit (or: npm ls <package>). - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| npm | next | >= 16.2.0, < 16.3.6 | 16.3.6 |
Details
Impact
The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution.
Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:
Applications using the Edge ImageResponse implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.
Workaround
If upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation from next/og.
CVSS: 9.5 (v4.0) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Sources and references
- GitHub Advisory GHSA-vcvr-r3jv-pc5j github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com