Next.js Faces Critical Vulnerability: A Threat to Server Security
A recent discovery has revealed a critical vulnerability within Next.js, a popular framework for server-rendered React applications. This vulnerability holds significant implications as it could allow unauthenticated remote attackers to execute arbitrary code on affected servers. The flaw lies in the way crafted input is handled during dynamic image generation, particularly when rendered into SVG content.
Background of the Vulnerability
This specific issue, tracked under the identifier GHSA-vcvr-r3jv-pc5j, is concentrated in the Node.js implementation of ImageResponse found within the next/og package. The affected versions of Next.js span from 16.2.0 to 16.3.5. In response to this threat, Vercel— the company behind Next.js— has promptly released an updated version, 16.3.6, which addresses the pressing security concern. Furthermore, for users still operating on the 15.x release line, a security hardening update identified as version 15.5.26 has also been issued.
The Mechanics of the Vulnerability
The vulnerability primarily exists within the ImageResponse component, which is frequently employed to generate Open Graph images, social media preview cards, and various server-generated graphics from JSX and CSS. During the image generation process, the application routes output through Satori, a library tasked with converting JSX-like layout data into SVG before creating an image.
The heart of the problem can be traced back to improper escaping of values incorporated into the generated SVG output. This flaw exposes applications when they accept any form of attacker-controlled data— such as query parameters, API values, or form inputs— and embed that data into SVG content, attributes, or CSS styles processed by Node.js ImageResponse. As a result, crafted inputs could inadvertently be interpreted as SVG markup, rather than mere inert text, setting the stage for potential remote code execution.
Potential Attack Scenarios
A practical illustration of a vulnerable implementation could look as follows:
import { ImageResponse } from 'next/og'
export async function GET(request: Request) {
const value = new URL(request.url).searchParams.get('value') ?? ''
return new ImageResponse(
<svg width="1200" height="630">
<title>{value}</title>
</svg>
)
}In this scenario, an attacker could send a deliberately crafted value parameter to an internet-facing image endpoint. If the application is operating using the vulnerable Node.js implementation that processes the input for SVG generation, the request could traverse into the compromised rendering chain.
Conditions and Limitations of the Vulnerability
It is important to note that not every Next.js application that employs ImageResponse is inherently vulnerable. The advisory stipulates certain conditions under which the vulnerability applies:
- The application must utilize Next.js versions ranging from 16.2.0 through 16.3.5.
- The exploitation must involve the
next/ogimage generation pathway via the Node.js implementation of ImageResponse. - Untrusted input must be able to reach SVG content, attributes, or CSS-style values.
- The image generation route must be accessible over the network, presenting an opportunity for attackers.
Importantly, applications utilizing the Edge ImageResponse implementation remain unaffected. Deployments that steer clear of embedding attacker-controlled data into SVG outputs are also outside the confines of the identified vulnerabilities.
Recommended Actions for Organizations
Given the serious nature of this vulnerability, organizations are urged to take immediate action. Specifically, it is recommended that all impacted Next.js deployments be upgraded to version 16.3.6 and applications should be redeployed accordingly. Teams should prioritize a thorough review of Open Graph image endpoints, route handlers, and dynamic preview-image generators that interact with request-controlled values.
For environments where immediate patching is not feasible, developers must ensure that untrusted input is excluded from SVG content, attributes, or styles within Node.js ImageResponse. Moreover, Satori itself was patched in version 0.33.5; however, its advisory cautions that no complete workaround exists for direct Satori usage aside from upgrading and avoiding the use of attacker-controlled rendered content.
In light of the potential for server-side code execution without requiring user authentication or interaction, exposed next/og image generation endpoints should be treated as high-priority targets for patching. The imperative to protect these vectors cannot be overstated, and proactive measures must be taken to fortify organizational defenses against such vulnerabilities.