Critical Next.js Bug Exposes Servers to Remote Code Execution via Malicious SVG Input
A severe vulnerability in the popular Next.js framework has been discovered, allowing attackers to execute arbitrary code on servers hosting applications that use its ImageResponse feature. The flaw, which can be exploited by submitting specially crafted SVG input, puts thousands of websites at risk of compromise.
Next.js is a widely-used JavaScript library for building server-side rendered (SSR) and statically generated websites. Its ImageResponse feature allows developers to generate images on the fly based on user inputs. However, researchers have found that this functionality can be exploited by submitting malicious SVG code, which can then be executed as system commands.
The vulnerability affects all versions of Next.js prior to 13.1.3, and its severity is rated as critical. An attacker with access to a website’s ImageResponse endpoint can submit an SVG input containing malicious JavaScript code, which will be executed by the server. This allows the attacker to gain remote code execution capabilities, effectively giving them control over the server.
The affected websites are primarily those built using Next.js’s ImageResponse feature for generating images or graphics on the fly. According to estimates, tens of thousands of websites may be vulnerable to this flaw. While not all of these sites use ImageResponse extensively, it is still essential for developers and administrators to take immediate action to mitigate the risk.
The exploit works by submitting an SVG input containing malicious JavaScript code that targets the server-side rendering engine. Once executed, the attacker can potentially gain control over the entire server, allowing them to install malware, steal sensitive data, or launch further attacks on other systems connected to the same network.
This vulnerability highlights the importance of securing user-inputted data and ensuring that all features and functionalities are thoroughly reviewed for potential security risks. Developers using Next.js should update their applications to the latest version (13.1.3) as soon as possible and take measures to validate and sanitize any input data submitted through ImageResponse endpoints.
To protect your website from this vulnerability, we recommend the following: ensure that all dependencies, including Next.js, are up-to-date; implement robust input validation and sanitization mechanisms for user-inputted data; and conduct regular security audits to identify potential weaknesses. By taking these steps, you can significantly reduce the risk of a successful attack and maintain the trust of your users.
Source: The Hacker News — 2026-09-23