importantSYS.SOURCE: The Hacker News• 2026-09-23T12:34:40+05:30

Critical Next.js ImageResponse Vulnerability Enables Server Code Execution Through Malicious SVG Input

#nextjs #svg #code-execution #server-side #web-security

A critical vulnerability in Next.js's ImageResponse feature allows server code execution through crafted SVG inputs, with a CVSS score of 9.5. The flaw was patched in version 16.3.6, affecting versions 16.2.0 through 16.3.5 when using the Node.js runtime.

A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said.

The risk applies when an app puts values an attacker controls, such as text read from the request URL, into the image. Vercel, which develops Next.js, fixed the flaw on September 22 in version

Read original article

*** END OF TRANSMISSION ***

> NETHERLANDS FACES POTENTIAL US SANCTIONS OVER ICC INVESTIGATIONS > STRATEGIC IMPLICATIONS OF ABANDONING SCIENTIFIC LINUX IN HIGH-PERFORMANCE COMPUTING ENVIRONMENTS > F5 ADDRESSES CRITICAL ZERO-DAY VULNERABILITY IN BIG-IP APM ALLOWING UNAUTHENTICATED RCE ON OAUTH SERVERS > CHINESE THREAT ACTORS EXPLOIT CHROME-WINDOWS ZERO-DAY CHAIN FOR CLEANGULP MALWARE DEPLOYMENT > IMPLEMENTING JEV CLASSIFICATION MODEL IN PYTHON > CRITICAL NEXT.JS IMAGERESPONSE VULNERABILITY ENABLES SERVER CODE EXECUTION THROUGH MALICIOUS SVG INPUT > THE 1893 WORLD'S FAIR'S LASTING CULTURAL IMPACT AND HISTORICAL REINTERPRETATIONS > SHINYHUNTERS ALLEGES FBI DATA BREACH INVOLVING AGENT AND APPLICANT INFORMATION > GREECE'S PRIME MINISTER ACKNOWLEDGES CHALLENGES IN ADAPTING TO AI ADVANCEMENTS > GRAMMARLY'S CANCELATION POLICY TRIGGERS AUTOMATED USER NOTIFICATIONS> NETHERLANDS FACES POTENTIAL US SANCTIONS OVER ICC INVESTIGATIONS > STRATEGIC IMPLICATIONS OF ABANDONING SCIENTIFIC LINUX IN HIGH-PERFORMANCE COMPUTING ENVIRONMENTS > F5 ADDRESSES CRITICAL ZERO-DAY VULNERABILITY IN BIG-IP APM ALLOWING UNAUTHENTICATED RCE ON OAUTH SERVERS > CHINESE THREAT ACTORS EXPLOIT CHROME-WINDOWS ZERO-DAY CHAIN FOR CLEANGULP MALWARE DEPLOYMENT > IMPLEMENTING JEV CLASSIFICATION MODEL IN PYTHON > CRITICAL NEXT.JS IMAGERESPONSE VULNERABILITY ENABLES SERVER CODE EXECUTION THROUGH MALICIOUS SVG INPUT > THE 1893 WORLD'S FAIR'S LASTING CULTURAL IMPACT AND HISTORICAL REINTERPRETATIONS > SHINYHUNTERS ALLEGES FBI DATA BREACH INVOLVING AGENT AND APPLICANT INFORMATION > GREECE'S PRIME MINISTER ACKNOWLEDGES CHALLENGES IN ADAPTING TO AI ADVANCEMENTS > GRAMMARLY'S CANCELATION POLICY TRIGGERS AUTOMATED USER NOTIFICATIONS