A critical security vulnerability in the Next.js ImageResponse feature allows attackers to achieve remote code execution on servers. The issue arises when untrusted user input, such as values derived from request URLs, is insecurely processed within SVG inputs. Vercel has released patches to resolve the flaw. Administrators must update affected applications immediately to prevent potential system compromise.
READ THE ORIGINAL ARTICLE AT THEHACKERNEWS.COM →