< Back

GHSA-vcvr-r3jv-pc5j

Updated on 30 Sep 2026

Severity

Awaiting Analysis

Details

Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Impact

The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution.

Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:

import { ImageResponse } from 'next/og'

export async function GET(request: Request) {
const value = new URL(request.url).searchParams.get('value') ?? ''

return new ImageResponse(
&lt;svg width="1200" height="630"&gt;
&lt;title&gt;{value}&lt;/title&gt;
&lt;/svg&gt;
)
}

Applications using the Edge ImageResponse implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.

Workaround

If upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation from next/og.

Details

Affected product:
Next.js , React , arcjet-js , auth0-nextjs-auth0 , aws-amplify-adapter-nextjs , bufbuild/connect-es , clerk-nextjs , connect-es , create-next-app , create-storybook , expo-next-adapter , fumadocs , fumadocs-ui , geist , hindsight , instantsearch , jovidecroock-prefresh , json-render-next , ledger-live , lit-labs-nextjs , module-federation-nextjs-mf , mui-docs , mui-material-nextjs , mysten-docs , nx-next , orama-orama , pigment-css , sanity-next-loader , sb , scalar-nextjs-api-reference , scalar-nextjs-openapi , sentry-nextjs , solana-wallet-adapter-example , storybook , storybook-addon-a11y , storybook-addon-docs , storybook-addon-links , storybook-addon-onboarding , storybook-addon-pseudo-states , storybook-addon-themes , storybook-addon-vitest , storybook-angular , storybook-angular-vite , storybook-cli , storybook-codemod , storybook-ember , storybook-experimental-nextjs-vite , storybook-html-vite , storybook-nextjs , storybook-nextjs-vite , storybook-preact , storybook-preset-create-react-app , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-react , storybook-react-dom-shim , storybook-react-native-web-vite , storybook-react-vite , storybook-react-webpack5 , storybook-server , storybook-server-webpack5 , storybook-tanstack-react , storybook-vue3 , storybook-vue3-vite , storybook-web-components , storybook-web-components-vite , tanstack-react-query-next-experimental , trpc-client , trpc-next , trpc-server , visual-editing , vite-plugin-storybook-nextjs , wyw-in-js , x402-next
Affected packages:
next @ 16.2.10 (+1038 more)