Next.js patches critical server code execution flaw in image generation

Image: Primary

Published Wednesday, September 23, 2026 · 5:07 AM EDT

Vercel fixed a critical Next.js flaw on September 22 that could let attackers run code on a server through ImageResponse, the feature used to generate social preview images. The risk applies when an application places attacker-controlled values into SVG content, attributes or styles while ImageResponse runs on Node.js. The flaw affects Next.js 16.2.0 through 16.3.5; version 16.3.6 contains the fix. Next.js 15 and the Edge version of ImageResponse are unaffected. The Hacker News found no public reports of attacks or exploit code as of September 23, and its check found that npm audit did not flag affected version 16.3.5.

Sources

The Hacker News

Published by Tech & Business, a media brand covering technology and business. This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

Security Infrastructure

Pwn.ai demonstrates Firecracker guest escape on a host running it as root

Pwn.ai says it escaped a Firecracker microVM and executed a chosen operation as root on the host while the virtual machine remained accessible over SSH.

Security Infrastructure

QNAP warns of suspected NAS compromises through Plex flaws

QNAP says it has received multiple reports of suspected compromises of customers' network storage devices through the Plex2Shell vulnerability chain. The company urges users to update Plex Media Server through its App Center to version 1.43.3.10861.

Security Infrastructure

Some WordPress sites remain exposed while installing security fix

Some WordPress sites remain vulnerable to server code execution while installing the fix for actively exploited CVE-2026-119977, researcher Umut Bayram warned.

Security

Chainalysis says breach exposed password hashes and live tokens for all users

Chainalysis said hackers obtained names, usernames, password hashes and live tokens for all its users following a breach of its network security.

Security

Gnosis Pay discloses customer data breach and adds payment checks

Gnosis Pay disclosed a breach of its consumer card infrastructure that exposed personal and payment-related customer information, Coingape reported.

Security

Veeam distributes fixes for critical Linux kernel vulnerability

Veeam said on Friday that some of its products are affected by CVE-2026-98432, a critical Linux kernel vulnerability, BleepingComputer reported. The flaw allows remote unauthenticated attackers to execute commands as root on servers running Multipath TCP listeners.