Next.js Social Preview Feature Has a Remote Code Execution Bug
A flaw in the ImageResponse feature of Next.js lets attackers inject malicious content into SVG image generation and run arbitrary code on the server.
Key points
- Vercel disclosed a remote code execution flaw in the Node.js version of
ImageResponsein Next.js on 22 September 2025, tracked in advisory GHSA-vcvr-r3jv-pc5j. - The bug traces back to Satori, the library Next.js uses to turn HTML and SVG into images, covered in advisory GHSA-wx4j-mvgx-mqwp.
- Only apps that feed attacker-controlled text into SVG content, attributes or styles are exposed.
- Apps running the Edge runtime version of
ImageResponseare not affected. - The workaround, if patching has to wait, is straightforward: stop passing user input into SVG output.
Next.js has a hole in the part that makes social-preview images, and it's bad enough to let an attacker run their own commands on the server.
The feature is ImageResponse from next/og, which generates Open Graph images: the thumbnail and title card that appear when someone posts a link on LinkedIn, Slack or X. Vercel published its security advisory on 22 September 2025. The Hacker News flagged the fix to a wider audience.
This is the second Next.js remote-code-execution vulnerability we've reported in recent months. In August we covered Vercel patching two critical bugs that could be triggered by a booby-trapped image or a rigged URL.
What actually goes wrong?
The flaw fires only in a specific setup: the app must use the Node.js version of ImageResponse and must take a value the visitor controls, say a word from the URL, and drop it into the SVG the image is built from without sanitising it first. SVG is a text-based format, so pasting untrusted input inside SVG tags or style blocks lets an attacker reshape the file's meaning entirely.
The root cause sits one layer down, in Satori, the open-source library Next.js uses to render HTML and SVG into pictures. Vercel's Satori advisory GHSA-wx4j-mvgx-mqwp covers the same weakness.
Who is affected, and who is not?
| Setup | Affected? |
|---|---|
Node.js ImageResponse with user input in SVG |
Yes |
Node.js ImageResponse, no user input in SVG |
No |
Edge runtime ImageResponse |
No |
Sites that only use static values, page titles hard-coded at build time or product names pulled from a trusted database, aren't in danger. The risky pattern is the one Vercel flags in its own advisory: reading a query string parameter and pushing it into an SVG <title> or similar element. Developers use exactly that pattern to build dynamic share cards, one per article or one per profile.
What should developers do now?
Upgrade Next.js to the patched release cited in the advisory. Then audit any route that uses ImageResponse for inputs the visitor can touch, including URL parameters, form data and cookies.
Can't patch immediately? Vercel's workaround is blunt: don't pass attacker-controlled values into SVG content, attributes or styles in the Node.js ImageResponse path. Swap the dynamic value for a safe placeholder until the fix is in.
Should you worry if you're not a developer?
Directly, no. The flaw requires a vulnerable app to be running. Indirectly, yes: a compromised server can expose the data of everyone who uses that app. If a service you rely on runs Next.js and hasn't patched, its users are at risk until it does.
My read: preview-image routes are the kind of thing a team ships once and forgets. Plenty of them quietly read from the URL, and that's exactly what makes this linger. Expect automated scanners to start probing /og and /api/og endpoints within days of this becoming widely known.
