Critical Next.js ImageResponse Flaw Allows Remote Code Execution via SVG

A severe security flaw in the popular React framework Next.js has been disclosed, enabling unauthenticated attackers to run arbitrary code on vulnerable servers by injecting malicious SVG data during dynamic image generation.

The vulnerability, cataloged under the GitHub Security Advisory identifier GHSA-vcvr-r3jv-pc5j, stems from the way the ImageResponse API processes user‑supplied content to produce on‑the‑fly images, often used for generating social‑media preview graphics. When crafted SVG payloads are rendered, they can trigger server‑side script execution, compromising the host environment.

Next.js, maintained by Vercel, is widely adopted for its seamless server‑side rendering and static site generation capabilities. Its ImageResponse feature, introduced to simplify creation of dynamic Open Graph images, has become a staple for many web applications. The flaw therefore has a broad attack surface, potentially affecting any site that relies on this API without stringent input sanitization.

Security researcher GBHackers first reported the issue, prompting an urgent review by the Next.js core team. According to the advisory, exploitation does not require prior authentication; an attacker can supply a specially crafted request that the server processes into an SVG, leading to code execution under the server’s privileges.

The Next.js maintainers responded by publishing a patch that tightens SVG handling and adds validation checks to prevent malicious payloads from reaching the rendering engine. Users are advised to upgrade to the patched version immediately and to review any custom image generation pipelines for similar weaknesses.

Industry analysts note that the incident underscores the risks inherent in server‑side image manipulation, especially when third‑party content is incorporated without robust sanitization. Organizations that rely on dynamic OG image services should audit their implementations and consider employing additional layers of security, such as content‑type validation and sandboxed rendering environments.

While the advisory does not list a specific CVE number, the GHSA identifier will likely be mapped to a CVE in due course, facilitating broader tracking across vulnerability databases. Security teams are urged to monitor updates from Vercel and to apply any recommended configuration changes.

As the ecosystem digests the fix, the episode serves as a reminder that even well‑maintained open‑source projects can harbor critical bugs, reinforcing the need for continuous security testing and prompt patch management in modern web development pipelines.