GHSA-vcvr-r3jv-pc5j: Npm/next vulnerability
Impact
The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution.
Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:
tsx import { ImageResponse } from 'next/og'
export async function GET(request: Request) { const value = new URL(request.url).searchParams.get('value') ?? ''
return new ImageResponse( <svg width="1200" height="630"> <title>{value}</title> </svg> ) }
Applications using the Edge ImageResponse implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.
Workaround
If upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation from next/og.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.3.6 - Compensating control
Do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation from next/og.
Event History
Frequently Asked Questions
Which applications are exposed to remote code execution?
Applications using the Node.js ImageResponse implementation from next/og are exposed when they place attacker-controlled values into SVG content, attributes, or styles during image generation. The example pattern is accepting a request parameter and rendering it into an SVG element.
Are applications using the Edge ImageResponse implementation affected?
No. Applications using the Edge ImageResponse implementation are not affected according to the advisory.
What can be done if upgrading is not immediately possible?
Do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation from next/og. Applications that never render attacker-controlled values in those SVG locations are not affected.