ImageResponse is a Next.js server-side API that turns JSX and CSS into an image, often for Open Graph and social preview cards. Instead of serving a static PNG, the application builds markup on the server, converts it to SVG or another rendered form, and returns the finished image to the requester.
Security matters because this pipeline processes structured markup, not just pixels. If attacker-controlled text reaches the template without strict escaping, it can break attributes, styles, or SVG content and become a parser injection problem. In real attacks, that can lead to markup corruption, data leakage, or, in the worst case, server-side code execution paths in the rendering stack. Defenders should treat every ImageResponse route as an internet-facing parser boundary: validate inputs, avoid reflecting raw request data, and keep the underlying framework patched. Even “cosmetic” preview endpoints can become high-value attack surfaces when they accept untrusted input.