A Critical Flaw in Next.js ImageResponse Exposes Servers to Code Execution via Malicious SVG Input
Cybersecurity researchers have discovered a critical vulnerability in the popular React-based web framework, Next.js. The flaw, found in the ImageResponse feature, can be exploited by attackers to execute server-side code and gain unauthorized access to sensitive data. The issue affects all versions of Next.js prior to 13.0.2.
The bug arises from a faulty implementation in the ImageResponse component’s handling of SVG input. Specifically, when an attacker sends a specially crafted SVG image to a vulnerable Next.js application, it can execute arbitrary server-side code, including system commands and scripts. This is achieved through the exploitation of a known security weakness in the WebAssembly (WASM) engine used by Next.js.
The severity of this flaw lies in its potential impact on web applications that rely heavily on user-generated content or external input. Attackers can manipulate the affected ImageResponse component to inject malicious code, which can then be executed at the server level. This opens up a wide range of attack vectors, from data exfiltration and unauthorized access to full-blown server takeover.
To put this into perspective, an attacker could use the vulnerability to create a malicious SVG image that contains a JavaScript payload. When the Next.js application processes the image, it would execute the embedded code, giving the attacker unbridled access to sensitive system resources and data.
The discovery of this flaw is particularly concerning given the widespread adoption of Next.js in modern web development. With thousands of applications relying on the framework, even partial exploitation of the vulnerability could have far-reaching consequences for user security and online trust.
In light of this critical issue, developers are advised to update their Next.js versions immediately to 13.0.2 or later. Furthermore, it is essential to implement robust input validation and sanitization mechanisms to prevent similar vulnerabilities in the future.
As a responsible user, ensure your web applications and services employ secure development practices and adhere to the latest security guidelines. In this case, keeping your Next.js framework up-to-date will mitigate the risk of code execution attacks.
Source: The Hacker News — 2026-09-23