{"action":"Upgrade next to 16.3.6 or later.","affected":[{"fixed":"16.3.6","introduced":"16.2.0"}],"component":"next","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["16.3.6"],"ghsa_id":"GHSA-vcvr-r3jv-pc5j","id":"tcs_01M5KGBKV5NSK735FSWPF2TBAH","modified_at":"2026-10-01T03:56:48.683494153Z","published_at":"2026-09-30T14:48:30Z","references":["https://osv.dev/vulnerability/GHSA-vcvr-r3jv-pc5j","https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j","https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp","https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e","https://github.com/vercel/next.js","https://github.com/vercel/next.js/releases/tag/v16.3.6"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-vcvr-r3jv-pc5j","url":"https://osv.dev/vulnerability/GHSA-vcvr-r3jv-pc5j"}],"summary":"Next.js: Remote Code Execution in next/og ImageResponse"}