security
Next.js fixes remote code execution issue in ImageResponse
An out-of-band Next.js security update fixes a critical issue in the Node.js ImageResponse implementation involving Satori and dependencies used to generate SVG.
On September 22, Next.js published an out-of-band security update for a critical remote code execution issue in a specific image-generation path. The problem affects the Node.js implementation of ImageResponse, exposed through next/og, and does not affect the Edge implementation.
The affected versions are Next.js releases from 16.2.0 through versions before 16.3.6. The technical origin is in the processing of SVG generated by Satori, a dependency used to produce images from components or structured content. According to the advisory, improper escaping of generated SVG, combined with vulnerabilities in upstream dependencies, could create a code-execution path under specific conditions.
The primary fix is Next.js 16.3.6, the recommended Active LTS release for the 16 branch. For the 15 branch, Next.js 15.5.26 includes related hardening, although that branch is not affected by the remote code execution issue described in the advisory. This distinction matters: the versions do not all require the same response, and remediation should not be replaced by a generic classification based only on the major branch.
The runtime also determines the scope. Applications using the Edge implementation of ImageResponse are not affected by this specific issue. An application generating responses through Node.js should check whether it uses next/og, even though that route may not look like a conventional network-facing attack surface. Image, document, template and SVG generators are input and output processors; their dependencies deserve the same scrutiny as an endpoint handling external data.
The incident offers several lessons for frontend teams. First, security advisories must be read at the level of version, runtime and API: “we use Next.js” is not a sufficient risk description. Second, transitive dependencies are part of the attack surface even when they do not appear in application code. Satori and its dependencies are not merely package-manager details when they participate in a production request path.
The immediate action is to check the installed version and apply the matching patch, for example with npm install next@16.3.6 for the 16 branch or npm install next@15.5.26 for the 15 branch. Teams should then review the locations that generate ImageResponse, validate the deployment pipeline and ensure tests cover generated-image routes. This does not require turning the incident into a complete framework audit, but it does require verifying that the real runtime matches the team’s assumption.
The practical conclusion is straightforward: frontend abstractions can encapsulate server-side code, parsers and native dependencies. Security has to follow that entire chain. A visual component may end up running a Node.js processor, which is why updates, dependency inventories and tests for generative routes belong to ordinary frontend maintenance as well.