chore(deps): update dependency next to v16.3.6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	16.3.4 → 16.3.6

---

Next.js: Remote Code Execution in next/og ImageResponse

GHSA-vcvr-r3jv-pc5j

More information

Details

Impact

The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution.

Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:

import { ImageResponse } from 'next/og'

export async function GET(request: Request) {
  const value = new URL(request.url).searchParams.get('value') ?? ''

  return new ImageResponse(
    <svg width="1200" height="630">
      <title>{value}</title>
    </svg>
  )
}

Applications using the Edge ImageResponse implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.

Workaround

If upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation from next/og.

Severity

• CVSS Score: 9.5 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

• https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j
• https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp
• https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e
• https://github.com/vercel/next.js/releases/tag/v16.3.6
• https://github.com/advisories/GHSA-vcvr-r3jv-pc5j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vercel/next.js (next)

v16.3.6

Compare Source

v16.3.5

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

<--- Last few GCs --->

[2446:0x3b91e000]   128663 ms: Scavenge 1392.1 (1430.7) -> 1377.7 (1436.5) MB, pooled: 0 MB, 15.35 / 0.00 ms  (average mu = 0.357, current mu = 0.349) allocation failure; 
[2446:0x3b91e000]   129738 ms: Mark-Compact (reduce) 1387.4 (1440.4) -> 1332.9 (1343.4) MB, pooled: 0 MB, 84.88 / 0.00 ms  (+ 945.5 ms in 211 steps since start of marking, biggest step 27.9 ms, walltime since start of marking 1075 ms) (average mu = 0.336,
FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----

 1: 0xf49c57 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/24.8.0/bin/node]
 2: 0x13a6050 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/24.8.0/bin/node]
 3: 0x13a613f v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/24.8.0/bin/node]
 4: 0x163ec25  [/opt/containerbase/tools/node/24.8.0/bin/node]
 5: 0x163ec52  [/opt/containerbase/tools/node/24.8.0/bin/node]
 6: 0x163ef4a v8::internal::Heap::RecomputeLimits(v8::internal::GarbageCollector, v8::base::TimeTicks) [/opt/containerbase/tools/node/24.8.0/bin/node]
 7: 0x164f46a  [/opt/containerbase/tools/node/24.8.0/bin/node]
 8: 0x1653810  [/opt/containerbase/tools/node/24.8.0/bin/node]
 9: 0x20e6641  [/opt/containerbase/tools/node/24.8.0/bin/node]
/usr/local/bin/node: line 18:  2446 Aborted                 /opt/containerbase/tools/node/24.8.0/bin/node "$@"

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1b78e84

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: TanStack/router/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: ee7b55c7-0b82-4371-8518-299ba030b63f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 1b78e84

---

☁️ Nx Cloud last updated this comment at 2026-10-03 23:24:05 UTC