Next.js ImageResponse flaw can lead to server code execution when attacker-controlled values reach generated SVG.
Next.js maintainers have released an out-of-band security update addressing two critical remote code execution vulnerabilities and a high-severity denial-of-service flaw.