Next.js CVE-2026-94545 (CVSS 9.5): ImageResponse Node runtime RCE via attacker-controlled SVG (fix 16.3.6)
Vercel GitHub advisory GHSA-vcvr-r3jv-pc5j (published 22 September 2026; CVE-2026-94545) documents remote code execution in the Node.js ImageResponse implementation from next/og when apps pass attacker-controlled values into SVG content, attributes, or styles. Vercel rates Critical with CVSS 4.0 9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). Affected: Next.js >=16.2.0 <16.3.6 on the Node.js runtime (default).
Not affected per the advisory: the Edge ImageResponse implementation, and apps that do not pass attacker-controlled values into SVG. Patched: 16.3.6 (22 Sep). Inventory routes importing ImageResponse from next/og that echo request/URL input into SVG; prefer not placing untrusted input in SVG title/attrs/styles until patched.
The advisory does not report in-the-wild exploitation. (source: Vercel advisory on GitHub)
Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Vercel advisory on GitHub)
- Product
- Next.js next/og ImageResponse (Node.js runtime; Satori SVG path)
- Versions
- Affected: Next.js >=16.2.0 and <16.3.6 when ImageResponse runs on Node.js and attacker-controlled values reach SVG content/attributes/styles. Fixed: 16.3.6. Not affected (per advisory): Edge ImageResponse.
- CVSS
- (CVSS 4.0 Critical; Vercel GHSA)
CVE-2026-94545CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Exploited in Australia?
- unknown
- Patch to
- Upgrade Next.js to 16.3.6 or later; inventory ImageResponse/next/og routes that echo request or URL parameters into SVG; avoid attacker-controlled SVG title/attrs/styles until patched; Edge runtime ImageResponse is outside the reported Node path