A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said.
The risk applies when an app puts values an attacker controls, such as text read from the request URL, into the image. Vercel, which develops Next.js, fixed the flaw on September 22 in version 16.3.6.
The flaw, tracked as CVE-2026-94545, affects Next.js 16.2.0 through 16.3.5 when ImageResponse runs on the Node.js runtime, which Next.js uses by default. Vercel’s advisory rates it critical, with a CVSS score of 9.5. The Edge version of ImageResponse is not affected, and neither is Next.js 15.
ImageResponse uses Satori, a Vercel library, to convert the image layout into SVG code before the final PNG is generated. Affected apps are those that “pass attacker-controlled values into SVG content, attributes, or styles during image generation”, according to the advisory.
The advisory’s example takes a value from the request URL and places it inside an SVG title element. It does not say whether text in ordinary elements, such as a heading inside a div, also counts.
To find where an app uses the feature, look for ImageResponse imported from next/og, for example in route handlers and in opengraph-image files. Route handlers make the image when a request arrives. An opengraph-image file can make it at build time or when a request arrives.
As of September 23, The Hacker News found no public reports of attacks using the flaw and no public exploit code.
The fix is Next.js 16.3.6, the only patched version, installed with npm install next@16.3.6. As of September 23, the npm registry listed no fixed release for the 16.2 line, so apps on 16.2 need to move to 16.3.6. Next.js 15.5.26 adds extra security hardening for next/og on the 15.5 line.
If upgrading has to wait, the advisory’s workaround is to keep attacker-controlled values out of the SVG content, attributes, and styles that the Node.js ImageResponse renders. The advisory does not suggest switching to the unaffected Edge version, and the Next.js documentation marks the Edge runtime as deprecated.
In checks by The Hacker News on September 23, npm audit did not flag Next.js 16.3.5, an affected version. The advisory was also not yet listed in the GitHub Advisory Database, and no CVE record for CVE-2026-94545 had been published.
Check the Next.js version directly. Satori is bundled inside the Next.js package, so a lockfile does not list it as a dependency of Next.js.
Vercel’s advisory and announcement do not say whether apps hosted on Vercel are protected. For two critical Next.js flaws fixed in August, the company said hosted apps were protected and needed no upgrade.
Vercel’s advisory and announcement also provide no way to check whether an affected route was abused before the patch. Affected versions have been available since Next.js 16.2 was released on March 18.
The bug itself is in Satori. Satori’s own advisory, published the same day, says certain values reached its SVG output without being properly escaped. A specially made value could then be read as SVG code instead of plain text.
In Next.js, such values could reach vulnerabilities in other libraries that Next.js depends on and lead to code execution, Vercel said. It has not named those libraries.
Satori’s advisory rates the same CVE as moderate, with a score of 5.3, and says the impact depends on how the SVG output is used. Developers who use Satori directly should update it to version 0.33.5, which has the fix.
