---
title: "GHSA-vcvr-r3jv-pc5j: Next.js: Remote Code Execution in next/og ImageResponse"
url: https://erroneo.us/security/ghsa/GHSA-vcvr-r3jv-pc5j/
description: "GHSA-vcvr-r3jv-pc5j (critical, npm): Next.js: Remote Code Execution in next/og ImageResponse. Impact The Node.js ImageResponse implementation from next/og…"
type: advisory
section: "Security Digest"
date_published: 2026-09-30
date_modified: 2026-09-30
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-vcvr-r3jv-pc5j"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-vcvr-r3jv-pc5j: Next.js: Remote Code Execution in next/og ImageResponse

## Affected packages

- npm `next` >= 16.2.0, < 16.3.6 → fixed: 16.3.6

## Details

Impact The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: Applications using the Edge ImageResponse implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected. Workaround If upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation from next/og.

## Sources

- [GitHub Advisory GHSA-vcvr-r3jv-pc5j](https://github.com/advisories/GHSA-vcvr-r3jv-pc5j)
- [github.com](https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j)
- [github.com](https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp)
- [github.com](https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e)
- [github.com](https://github.com/vercel/next.js/releases/tag/v16.3.6)

---
Source page: https://erroneo.us/security/ghsa/GHSA-vcvr-r3jv-pc5j/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt