Vercel fixes critical Next.js ImageResponse flaw enabling server code execution

September 23, 2026 at 12:04 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Vercel released Next.js 16.3.6 on September 22 to fix a critical vulnerability in the ImageResponse feature that could allow server code execution via crafted SVG input. The flaw, tracked as CVE-2026-94545, affects Next.js versions 16.2.0 through 16.3.5 when ImageResponse runs on the default Node.js runtime. No public exploits or attacks have been reported as of September 23.

Key Facts

CVE-2026-94545 affects Next.js 16.2.0 through 16.3.5 when ImageResponse runs on the Node.js runtime, which is the default.
Vercel rates the flaw critical with a CVSS score of 9.5.
The fix is Next.js 16.3.6, released on September 22, and it is the only patched version.
The Edge version of ImageResponse and Next.js 15 are not affected.
As of September 23, no public exploit code or reports of attacks using the flaw have been found.

Vulnerability Details

The vulnerability resides in ImageResponse, the Next.js feature that generates Open Graph and other social preview images. ImageResponse uses Satori, a Vercel library, to convert the image layout into SVG code before generating the final PNG. Affected applications are those that pass attacker-controlled values into SVG content, attributes, or styles during image generation, according to Vercel's advisory. The advisory's example takes a value from the request URL and places it inside an SVG title element. The advisory does not specify whether text in ordinary elements, such as a heading inside a div, also counts as vulnerable.

Affected Versions and Fix

The flaw affects Next.js 16.2.0 through 16.3.5 when ImageResponse runs on the Node.js runtime, which Next.js uses by default. Vercel fixed the flaw on September 22 in version 16.3.6, the only patched release. As of September 23, the npm registry listed no fixed release for the 16.2 line, so applications on 16.2 must upgrade to 16.3.6. Next.js 15.5.26 adds extra security hardening for next/og on the 15.5 line. The Edge version of ImageResponse is not affected, and neither is Next.js 15.

Detection and Workarounds

To find where an application uses the feature, developers should look for ImageResponse imported from next/og, for example in route handlers and opengraph-image files. Route handlers generate the image when a request arrives, while an opengraph-image file can generate it at build time or on request. If upgrading must be delayed, Vercel's advisory recommends keeping attacker-controlled values out of the SVG content, attributes, and styles that the Node.js ImageResponse renders. The advisory does not suggest switching to the unaffected Edge version, and the Next.js documentation marks the Edge runtime as deprecated. As of September 23, npm audit did not flag Next.js 16.3.5, an affected version, and the advisory was not yet listed in the GitHub Advisory Database.