Full Report
A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said. The risk applies when an app puts values an attacker controls, such as text read from the request URL, into the image. Vercel, which develops Next.js, fixed the flaw on September 22 in version
Analysis Summary
# Vulnerability: Next.js ImageResponse Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2026-94545
- **CVSS Score:** 9.5 (Critical) - per Vercel; 5.3 (Moderate) - per Satori
- **CWE:** Improper Output Neutralization (Injection)
## Affected Systems
- **Products:** Next.js, Satori (underlying library)
- **Versions:**
- Next.js: 16.2.0 through 16.3.5
- Satori: Versions prior to 0.33.5
- **Configurations:**
- Applications using `ImageResponse` (imported from `next/og`) in Route Handlers or `opengraph-image` files.
- Specifically affects the **Node.js runtime** (Next.js default). The Edge runtime is reportedly not affected.
## Vulnerability Description
The flaw resides in the Satori library, which Next.js uses to convert HTML/CSS into SVG code for image generation. The library fails to properly escape certain values before they are included in the SVG output. If an application passes attacker-controlled input (e.g., text from a URL query parameter) directly into SVG content, attributes, or styles, an attacker can inject malicious SVG code. In the Next.js Node.js environment, this SVG injection can interact with other internal dependencies to achieve Remote Code Execution (RCE).
## Exploitation
- **Status:** No reports of exploitation in the wild; no public PoC available (as of Sept 23, 2026).
- **Complexity:** Medium
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full server compromise possible)
- **Integrity:** High
- **Availability:** High
## Remediation
### Patches
- **Next.js:** Upgrade to version **16.3.6** via `npm install [email protected]`.
- **Satori:** If used as a standalone library, upgrade to version **0.33.5**.
- **Note:** Users on the 16.2 line must upgrade to 16.3.6 as no backported fix for 16.2 was available at the time of the report.
### Workarounds
- Sanitize all user-supplied data before passing it to `ImageResponse`.
- Avoid placing attacker-controlled values directly into SVG content, attributes, or styles.
## Detection
- **Indicators of Compromise:** Unusual outbound network traffic from the Node.js server or unexpected file system changes originating from the `ImageResponse` process.
- **Detection Methods:**
- Manually check `package.json` for Next.js versions between 16.2.0 and 16.3.5.
- **Note:** `npm audit` may not flag the vulnerability immediately as Satori is bundled within Next.js and not listed as a top-level dependency.
- Audit source code for imports of `next/og` and verify how external input is handled in those functions.
## References
- **Vercel Advisory:** hxxps://github[.]com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j
- **Satori Advisory:** hxxps://github[.]com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp
- **Next.js Security Update:** hxxps://nextjs[.]org/blog/nextjs-security-update-september-22-2026