Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input

Summary

A critical vulnerability (CVE-2026-94545) in Next.js's ImageResponse feature allows attackers to execute code on a server by crafting SVG input. The flaw, which affects versions 16.2.0 through 16.3.5 when using the Node.js runtime, arises when user-controlled values are improperly handled within SVG content. Vercel has released version 16.3.6 to fix the issue, with a CVSS score of 9.5.

Full text

Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input Swati KhandelwalSep 23, 2026Vulnerability / Web Security A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said. The risk applies when an app puts values an attacker controls, such as text read from the request URL, into the image. Vercel, which develops Next.js, fixed the flaw on September 22 in version 16.3.6. The flaw, tracked as CVE-2026-94545, affects Next.js 16.2.0 through 16.3.5 when ImageResponse runs on the Node.js runtime, which Next.js uses by default. Vercel's advisory rates it critical, with a CVSS score of 9.5. The Edge version of ImageResponse is not affected, and neither is Next.js 15. ImageResponse uses Satori, a Vercel library, to convert the image layout into SVG code before the final PNG is generated. Affected apps are those that "pass attacker-controlled values into SVG content, attributes, or styles during image generation", according to the advisory. The advisory's example takes a value from the request URL and places it inside an SVG title element. It does not say whether text in ordinary elements, such as a heading inside a div, also counts. To find where an app uses the feature, look for ImageResponse imported from next/og, for example in route handlers and in opengraph-image files. Route handlers make the image when a request arrives. An opengraph-image file can make it at build time or when a request arrives. As of September 23, The Hacker News found no public reports of attacks using the flaw and no public exploit code. The fix is Next.js 16.3.6, the only patched version, installed with npm install next@16.3.6. As of September 23, the npm registry listed no fixed release for the 16.2 line, so apps on 16.2 need to move to 16.3.6. Next.js 15.5.26 adds extra security hardening for next/og on the 15.5 line. If upgrading has to wait, the advisory's workaround is to keep attacker-controlled values out of the SVG content, attributes, and styles that the Node.js ImageResponse renders. The advisory does not suggest switching to the unaffected Edge version, and the Next.js documentation marks the Edge runtime as deprecated. In checks by The Hacker News on September 23, npm audit did not flag Next.js 16.3.5, an affected version. The advisory was also not yet listed in the GitHub Advisory Database, and no CVE record for CVE-2026-94545 had been published. Check the Next.js version directly. Satori is bundled inside the Next.js package, so a lockfile does not list it as a dependency of Next.js. Vercel's advisory and announcement do not say whether apps hosted on Vercel are protected. For two critical Next.js flaws fixed in August, the company said hosted apps were protected and needed no upgrade. Vercel's advisory and announcement also provide no way to check whether an affected route was abused before the patch. Affected versions have been available since Next.js 16.2 was released on March 18. The bug itself is in Satori. Satori's own advisory, published the same day, says certain values reached its SVG output without being properly escaped. A specially made value could then be read as SVG code instead of plain text. In Next.js, such values could reach vulnerabilities in other libraries that Next.js depends on and lead to code execution, Vercel said. It has not named those libraries. Satori's advisory rates the same CVE as moderate, with a score of 5.3, and says the impact depends on how the SVG output is used. Developers who use Satori directly should update it to version 0.33.5, which has the fix. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Open Source, Vulnerability, Web Security ⚡ Top Stories This Week Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up OpenAI Reveals Six Model Incidents Involving Hidden Failures and Unauthorized Uploads Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It. How to Evaluate a Unified Security Platform Using a One-Incident Test Stop Trying to Control AI Behavior. Control What AI Can Reach ⭐ Featured Resources Validation Summit ’26: See How Pen Testing, Exposure Validation and BAS Work Together Red Teams: Learn How Attack Path Chaining Changes Automated Security Testing Turn Threat Intelligence Into Verified Risk With Threat-Led Penetration Testing Deploy Browser Security Monitoring in Minutes With a Single Header

Indicators of Compromise

• cve — CVE-2026-94545

Entities