UpHeron
All vulnerabilities

npm

GHSA-vcvr-r3jv-pc5j

Next.js: Remote Code Execution in next/og ImageResponse

Severity
Critical
Published
30 Sept 2026
Last changed
1 Oct 2026
Added to UpHeron
14 Oct 2026
Fixed in
16.3.6
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
Next.jsnpm · osv:npm:next
  • From 16.2.0 before 16.3.6

References