30 Sept 2026 · TrustList Editorial
Next.js flaw in next/og ImageResponse allows remote code execution: upgrade to 16.3.6
Vercel’s advisory of 30 September 2026 says the Node.js ImageResponse in next/og, in Next.js 16.2.0 up to 16.3.6, can allow remote code…














