Next.js Security Update for a Critical Upstream Issue

Sebastian Silbermann,

Josh Story,

Karim Rahal

An out-of-band security update is now available in v16.3.6 (Active LTS) and v15.5.26 (Maintenance LTS). These releases upgrade upstream dependencies, including Satori, to address an issue that could lead to remote code execution in affected Next.js versions. Version 15.5.26 includes related hardening, but Next.js 15.x is not affected by the remote code execution issue.

Please patch your Next.js dependencies to maintain the security of your applications.

npm install [email protected]   # for 16.3
npm install [email protected]  # for 15.5 (hardening only)

Copy link to headingImpact

Copy link to headingRemote Code Execution in Node.js ImageResponse (Critical Severity)

GHSA-vcvr-r3jv-pc5j (Next.js)

Related upstream advisory: GHSA-wx4j-mvgx-mqwp (Satori)

Next.js versions

>=16.2.0 <16.3.6

are affected.

The issue affects the Node.js

ImageResponse

implementation in

next/og

. Under specific conditions, improper escaping in SVG output generated by Satori could lead to remote code execution due to vulnerabilities in other upstream dependencies. The fix upgrades those dependencies.

Applications using the Edge

ImageResponse

implementation are not affected.

Copy link to headingOur security program

We work with a talented set of researchers to secure Next.js and other open source frameworks through Vercel's Open Source Bug Bounty. Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.

Any questions or concerns regarding our security programs or vulnerability management can be sent to [email protected].