Critical Next.js ImageResponse Flaw Could Lead to Server Code Execution

Introduction

Next.js has long been celebrated for its developer experience and rapid application deployment capabilities. However, even the most popular frameworks face vulnerabilities when developers integrate external assets dynamically. One such emerging threat involves the ImageResponse feature, which is designed to generate optimized open graph images and social media previews automatically. While convenient, this functionality presents a potential security surface that can be exploited if not properly secured.

The recent discovery of a critical flaw in Next.js' ImageResponse implementation reveals how carefully crafted SVG inputs can bypass security checks and lead to severe consequences. Attackers who can supply malicious SVG data may compromise servers running this functionality, opening the door to remote code execution. Understanding this vulnerability is essential for both Next.js users and security professionals monitoring web application safety.

Newly Discovered Code Execution Risk in ImageResponse

At the heart of the issue lies a flaw in how Next.js processes SVG content within the ImageResponse component. When applications construct image responses using user-provided data—particularly text extracted from query parameters, cookies, or other untrusted sources—the system fails to adequately validate or sanitize the input before rendering. This oversight creates an opportunity for adversarial attacks where an attacker can embed malicious JavaScript or executable payloads directly within SVG elements.

• Untrusted Input Handling: Developers often pass dynamic values into the image generation process without strict validation.
• SVG Parsing Vulnerability: The underlying parser may interpret certain SVG constructs as executable code rather than safe markup.
• Server-Side Exploitation Path: Once compromised, the vulnerable endpoint can execute arbitrary commands on the host machine.

In practice, a malicious actor could craft an SVG file containing embedded JavaScript that executes when the browser attempts to render it. Because ImageResponse generates HTML snippets based on these SVG inputs, the payload gets inlined into the final page, potentially leading to script execution in any context where the rendered image is displayed.

Technical Mechanism of the Exploit

The exploit leverages the difference between static and dynamic SVG processing in Next.js. When an attacker controls the input text—such as through a manipulated URL parameter—that same text becomes part of the SVG source code. If the framework does not escape special characters or treat them as plain text rather than executable instructions, the resulting SVG can trigger unintended behavior.

1. An attacker crafts an SVG string containing malicious JavaScript within `