vulnerability · Wed 30 Sep 2026 · 14:48 UTC
GHSA-vcvr-r3jv-pc5j: Next.js: Remote Code Execution in next/og ImageResponse
Filed UTCSource GTH ↗
The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: ```tsx import { ImageResponse } from 'next/og' export async function GET(request: Request) { const value = new URL(request.url).searchParams.get('value') ?? …
Signals
as the pipeline stamped them- High
- Critical vulnerability
- What to do
- Critical severity — schedule an urgent patch.
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.