GHSA-vcvr-r3jv-pc5j
Next.js: Remote Code Execution in next/og ImageResponse
The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution.
- No known exploitation
- Severity
- Critical, CVSS 9.5 (v4.0)
- Affected packages
- next (npm) >= 16.2.0, < 16.3.6, fixed in 16.3.6 · GHSA-vcvr-r3jv-pc5j