Next.js shipped an out-of-band security release on September 22, patching CVE-2026-94545, a critical remote code execution flaw in the framework’s ImageResponse API. The bug lives in next/og’s Node.js runtime implementation, the code path that generates Open Graph and social preview images, and it carries a CVSS score of 9.5. Versions 16.2.0 through 16.3.5 are affected. Upgrading to 16.3.6, or 15.5.26 for the 15.x hardening release, closes it. If your app passes any request-derived value into an ImageResponse call, treat this as urgent.
What CVE-2026-94545 Actually Does
ImageResponse works by rendering JSX into SVG through a library called Satori, then converting that SVG into a PNG. The vulnerability sits in how Satori escapes values before they land in that SVG output. When an app builds an og-image route that reads a query parameter, a search result, or any other untrusted string and drops it straight into the rendered content, style, or attributes, that string can break out of its expected context. Next.js’s own advisory spells out the exact shape of the mistake: pulling a value with something like new URL(request.url).searchParams.get('value') and feeding it into the image without sanitizing it first.
Because the bug lives in Satori rather than in Next.js’s own code, the framework’s fix is an upstream dependency bump rather than a patch to application logic. Vercel tracks the issue under GHSA-vcvr-r3jv-pc5j, with a matching advisory on Satori’s own repository.
Who’s Affected
Only the Node.js runtime implementation of ImageResponse is exploitable here. If your og-image or twitter-image routes run on the Edge runtime, this specific flaw doesn’t reach you, though it’s still worth upgrading since 16.3.6 bundles other hardening. Next.js 15.x was never vulnerable to the RCE itself, but the 15.5.26 release ships the same defensive changes as a precaution.
The realistic risk shows up in any dynamic image generation endpoint that a marketing team, a blog, or a SaaS dashboard built to auto-generate share cards, where the title, a username, or a query string ends up rendered inside the image. That’s a common pattern, and it’s exactly the kind of thing that gets built fast and never revisited once it works.
How to Patch It
- Check your installed version: anything from 16.2.0 up to and including 16.3.5 needs the fix.
- Upgrade:
npm install [email protected]for the 16.3 line, ornpm install [email protected]for 15.5. - If you can’t patch immediately, audit every ImageResponse call for request-derived input and sanitize it before it reaches the rendered SVG rather than trusting the framework to do it for you.
- Redeploy. This isn’t the kind of fix that benefits from waiting for a scheduled release window; Vercel shipped it out-of-band for a reason.
This is the second Next.js security release in under a month, following the critical patch that landed in August, and Vercel has already flagged a third, broader security release for September 30. Teams running Next.js in production are better off building a habit of checking the framework’s security tag rather than reacting to each release individually. It’s the same discipline that matters for any Node.js dependency chain, which is worth remembering after npm’s own recent supply chain problems: the framework you trust is only as safe as the libraries it pulls in.
If you’re running a custom Next.js application and aren’t sure whether your image-generation routes are exposed, that’s exactly the kind of gap a web application development audit catches before it becomes an incident.
