A critical Next.js flaw could allow remote code execution via the Node.js ImageResponse implementation in next/og.
In the early hours of September 25, 2026, the server logs for the site we operate showed a clear change in how OpenAI's ...