CVE-2026-94545 – From JSX to SVG Injection
Next.js 16.3.6 update addresses CVE-2026-94545, an SVG injection vulnerability.
A new vulnerability, CVE-2026-94545, has been discovered in Next.js, allowing for JSX to SVG injection. Users running Next.js versions prior to 16.3.6 are advised to update immediately. The vulnerability does not affect Next.js 15 or the Edge ImageResponse implementation. Checkmarx's SCA tool already supports detection and will flag affected applications.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Checkmarx?
Get an email when a new story names Checkmarx, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCVE-2026-94545 exposes a JSX-to-SVG injection vulnerability in Next.js versions prior to 16.3.6, which could allow attackers to inject malicious SVG content through JSX rendering pathways. SVG injection can be weaponized to execute cross-site scripting (XSS) attacks, exfiltrate data, or manipulate the DOM in unexpected ways, making this a high-severity concern for any application that renders user-influenced content. The fact that a widely-used framework like Next.js carries this flaw highlights the critical importance of tracking third-party dependency versions continuously. Delayed patching in web frameworks often translates directly into exploitable attack surfaces in production environments.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-94545