Next.js ImageResponse Flaw Enables Server Code Execution

A critical security flaw in the popular web framework Next.js has been identified that allows attackers to execute arbitrary code on servers. The vulnerability exists within ImageResponse, a feature designed to generate social preview images such as Open Graph tags, and was fixed on September 22 in version 16.3.6.

The risk arises when applications insert user-controlled data, such as text from a request URL, into the image generation process. Vercel, the developer of Next.js, rates the issue as critical with a CVSS score of 9.5, highlighting the severe potential for server compromise if unpatched versions are used.

Vulnerability Scope and Technical Mechanism

The flaw affects Next.js versions 16.2.0 through 16.3.5 when running on the default Node.js runtime. It stems from Satori, a library used to convert layouts into SVG code, which failed to properly escape certain values. This allowed specially crafted input to be interpreted as executable SVG code rather than plain text.

Developers are advised to check for imports of ImageResponse from next/og in route handlers or opengraph-image files. While the Edge version of ImageResponse is not affected, Vercel has deprecated that runtime, meaning most standard deployments remain vulnerable.

Patch Availability and Workarounds

The only patched version is 16.3.6, which can be installed via npm. Applications still on the 16.2 line have no direct patch and must upgrade to 16.3.6. For those unable to upgrade immediately, the recommended workaround is to ensure no attacker-controlled values are passed into SVG content, attributes, or styles.

The Hacker News reported that as of September 23, no public exploit code or active attacks had been observed. However, Vercel has not confirmed whether apps hosted on their own platform are automatically protected, leaving self-hosted users fully responsible for applying the fix.

Detection Challenges and Audit Gaps

Security tools have struggled to detect the issue automatically. npm audit did not flag affected versions like 16.3.5, and the CVE was missing from the GitHub Advisory Database. Since Satori is bundled inside Next.js, it does not appear as a separate dependency in lockfiles, making manual version checks necessary.

There is currently no method provided by Vercel to determine if affected routes were abused prior to the patch. Given that affected versions have been available since March, organizations must assume potential exposure and verify their configurations directly.