Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Applications utilizing Next.js versions 16.2.0 through 16.3.5
Incident: A critical vulnerability in the Next.js ImageResponse feature allows for server-side code execution.
Impact: Potential full server compromise via remote code execution.
Attacker: Unidentified threat actors
Analysis: The vulnerability resides in how the Satori library handles input for ImageResponse, failing to properly escape attacker-controlled values in SVG elements. When processed by the Node.js runtime, these inputs can trigger remote code execution. While no public exploits have been reported yet, the vulnerability is rated critical with a CVSS score of 9.5.
Recommendations: Update Next.js to version 16.3.6 or higher immediately.; For direct users of the Satori library, upgrade to version 0.33.5.; Ensure all user-supplied input is strictly sanitized before being passed to SVG generation functions.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source