Critical Next.js ImageResponse flaw allows server code execution

Vercel disclosed a vulnerability in Next.js that lets attackers execute code on the server via ImageResponse, the feature that generates Open Graph and social preview images. The risk applies when an app feeds attacker-controlled values, such as text from the request URL, into the image. A fix shipped on September 22.

• The flaw affects the ImageResponse feature in Next.js
• Exploitation is possible via crafted SVG input
• Risk arises when URL-derived data is rendered into images
• Vercel released a fix on September 22