A security vulnerability in Next.js could allow attackers to execute code on a server via ImageResponse, the function that generates Open Graph and other social preview images. Vercel, the company that develops Next.js, disclosed the vulnerability and released a patch on September 22, 2026.
The vulnerability is tracked as CVE-2026-94545 and has a CVSS score of 9.5. It affects Next.js versions 16.2.0 through 16.3.5 when ImageResponse is executed in the Node.js runtime (default setting). The vulnerability occurs when an application places values that the attacker controls — such as text read from the request URL — into the image.
According to The Hacker News, there are no public reports of attacks exploiting this vulnerability, nor is there any public exploit. However, the severity of the CVSS and the way the vulnerability operates make it urgent to update immediately.
How the Next.js ImageResponse vulnerability works
ImageResponse uses Vercel 's Satori library to convert the image layout to SVG code before creating the final PNG file. The problem is that some values arrive in the SVG output without being properly escaped . This means that a specially formatted value can be interpreted as SVG code instead of plain text.
The affected applications are those that “ pass values controlled by an attacker to SVG, attributes, or styles when creating images content ,” according to Vercel’s announcement. The example given in the announcement takes a value from the request URL and places it inside an SVG title element .
In Next.js, such values can reach vulnerabilities in other libraries that Next.js depends on and lead to remote code execution , according to Vercel. The company has not named these libraries. It is worth noting that the Edge version of ImageResponse is not affected, nor is Next.js 15 .
How to know if you are affected
To identify whether your application uses the affected feature, look for the ImageResponse imported by next/og , for example in route handlers and opengraph-image files . Route handlers create the image when a request arrives. An opengraph-image file can create it during build or when a request arrives.
Important note: the npm audit did not detect Next.js 16.3.5 — an affected version — as vulnerable during the 23 September. Also, the announcement had not yet been registered in the GitHub Advisory Database, and no official CVE for CVE-2026-94545. This means that automated security scans may not detect the vulnerability — so it is necessary to check the Next.js directly.
See also: CodeAstro QR Code Attendance: Critical vulnerability with public exploit
Additionally, the Satori is embedded within the Next.js, so a lockfile does not list it as a separate dependency of Next.js. This makes it even more difficult to automatically detect the vulnerability through scanning tools.
Fix and workarounds for Next.js ImageResponse
The fix is in Next.js 16.3.6 , which is the only patched version and is installed with the command npm install next@16.3.6 . The npm registry does not list any patched versions for the 16.2 series , so applications using Next.js 16.2 should upgrade to 16.3.6 . Next.js 15.5.26 adds additional security enhancements for next/og in the 15.5 series .
If the upgrade must be postponed, the temporary solution is to exclude attacker-controlled values from SVG, attributes, and styles rendered by Node.js ImageResponse. The announcement does not recommend migrating to the Edge, as the Next.js describes the Edge runtime as deprecated.
For developers using the Satori library directly, Satori 's security advisory — published the same day — rates the same CVE as "moderate" with a score of 5.3 and states that the impact depends on how the SVG output is used . The fix for Satori is in version 0.33.5 .
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Check Point Management Server: Critical zero-day in targeted attacks
It is worth noting that Vercel has not clarified whether applications hosted on its platform are automatically protected. For two critical Next.js vulnerabilities that a corresponding statement this time leaves the question open for users of the Vercel platform.
The announcement also provides no way to check whether an affected route has been exploited before the fix was applied. The affected versions were available as of March 18, 2026, when Next.js 16.2, meaning the vulnerability was present for about six months before it was discovered and fixed.
