Next.js ImageResponse Vulnerability Enables Server‑Side Code Execution via Malicious SVG

On September 21, 2026, security researchers disclosed a critical flaw in the ImageResponse API of the popular React framework Next.js. The vulnerability allows an attacker who can influence the content of a generated image—typically SVG—to execute arbitrary code on the host server. The issue was patched by Vercel on September 22 in a new Next.js release.

#What Happened

Next.js’s ImageResponse function is widely used to create dynamic Open Graph and social preview images on the fly. The function renders a React component to an SVG, then rasterizes it for delivery. Researchers found that when the component incorporates user‑controlled data—such as query‑string parameters or path segments—into the SVG markup, the underlying SVG parser can be tricked into executing embedded JavaScript. Because the rasterization runs in the same Node.js process that serves the request, the malicious payload gains the same privileges as the application itself, effectively achieving server‑side code execution (RCE).

The flaw is not a generic XSS bug; it bypasses the usual browser sandbox because the SVG never reaches a client. Instead, the server‑side rendering pipeline processes the SVG directly, and the malicious payload runs before the image is converted to a bitmap.

#How the Exploit Works

1. Attacker supplies crafted SVG data – The attacker injects a payload via a URL parameter that the application later interpolates into a React component used by ImageResponse.
2. Component renders malicious SVG – The component outputs an <svg> element containing a <script> tag or a malformed attribute that triggers the SVG parser’s execution path.
3. Server‑side rasterizer processes the SVG – Next.js’s internal rasterizer (based on @vercel/og) parses the SVG. The parser, due to insufficient sanitisation, executes the embedded script in the Node.js context.
4. Arbitrary code runs – The script can import Node modules, read environment variables, or spawn child processes, giving the attacker full control over the server.

The attack chain hinges on attacker‑controlled values being inserted into the image without proper sanitisation—a condition the researchers observed in several open‑source examples and production sites.

#Who Is Affected

Any Next.js application that:

• Uses ImageResponse to generate images on demand, and
• Incorporates request‑derived data (e.g., URL parameters, query strings) into the rendered component

is potentially vulnerable. The issue does not affect static image generation or uses of ImageResponse that strictly supply constant strings.

#Why This Matters

Why This Matters

The flaw turns a convenience feature—dynamic social preview images—into a remote code execution vector. Because Next.js powers thousands of commercial sites and SaaS platforms, a single unpatched instance can expose sensitive data, compromise API keys, or become a foothold for broader supply‑chain attacks. The rapid release of a patch underscores the severity and the need for immediate remediation.

#Mitigation Steps

1. Update Next.js – Run the following command to upgrade to the patched version:
   bashCopy

   npm install next@13.5.2
   # or, if using Yarn
   yarn add next@13.5.2
   

2. Audit ImageResponse usage – Search the codebase for ImageResponse calls. Ensure that any data interpolated into the component is strictly validated and escaped. Prefer whitelisting allowed characters over generic sanitisation.
3. Apply a CSP header – While CSP cannot stop server‑side execution, it mitigates downstream XSS if the rendered image ever reaches a browser.
4. Enable runtime checks – Add a wrapper that rejects requests containing suspicious SVG fragments (e.g., <script>, onload=) before they reach the renderer.
5. Monitor logs for abnormal activity – Look for unexpected child_process spawns, file reads, or outbound network connections originating from the image generation endpoint.

#What Vercel Fixed

Vercel’s security advisory, published on September 22, 2026, introduced two key changes:

• Sanitisation layer – The rasterizer now strips any <script> tags and disallows executable attributes within SVGs generated by ImageResponse.
• Isolation – Rendering now occurs in a separate worker thread, limiting the impact of any residual code execution to the worker’s sandbox.

Developers can review the full release notes on the official Next.js GitHub release page.

#What to Watch Next

• CVE assignment – Security researchers expect a CVE identifier to be issued in the coming weeks. Tracking the assignment will help security teams reference the vulnerability in vulnerability management tools.
• Supply‑chain scanning – Organizations that ship Next.js‑based SaaS products should scan their CI pipelines for outdated dependencies and verify that the patched version is propagated to all environments, including staging and CI runners.
• Potential exploitation – No public exploits have been observed yet, but the vulnerability’s severity and ease of exploitation make it a prime candidate for rapid weaponisation. Threat‑intel feeds should be monitored for indicators of compromise related to the ImageResponse endpoint.

Developers who cannot upgrade immediately should consider temporarily disabling the ImageResponse route or switching to a server‑side image generation service that performs its own sanitisation.

---

For ongoing updates, follow the Vercel security advisory page and subscribe to the Next.js release RSS feed.

---

#Primary Sources & Official References

• Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input