Developer
Next.js 16.3.6 Fixes a Critical Remote Code Execution Flaw in next/og ImageResponse
Next.js 16.3.6 patches a critical flaw in the Node.js ImageResponse implementation from next/og that can lead to remote code execution in versions 16.2.0 to 16.3.5.
Source: Next.js GitHub releases1 min read