A critical Next.js vulnerability, tracked as CVE-2026-94545, has put a wide range of production applications at risk. The flaw affects the Node.js ImageResponse implementation inside the next/og package and can allow full remote code execution when an application renders attacker controlled SVG content. Given how commonly ImageResponse is used to generate Open Graph images and social media previews, this Next.js vulnerability deserves immediate attention from any team running an affected version.
This is also a useful case study in application security more broadly, touching on vulnerability management, patch management, zero day exploit response, and the growing risk that comes with cloud application security in framework heavy environments.
Table of Contents
- What Happened
- Which Versions Are Affected
- How the Vulnerability Works
- Why This Next.js Vulnerability Is So Severe
- Who Is at Risk
- How to Fix It
- Vulnerability Management Lessons From This Incident
- Patch Management Best Practices for Framework Vulnerabilities
- Cloud Application Security Implications
- Building a Vulnerability Management Dashboard for Faster Response
- Frequently Asked Questions
- Get a Professional Security Assessment
What Happened
Vercel, the company behind Next.js, disclosed that attackers could run code on a server through ImageResponse, the feature responsible for generating Open Graph and other social preview images. Vercel fixed the issue on September 22 with the release of version 16.3.6, and the advisory rates the flaw as critical with a CVSS score of 9.5. This makes it one of the more serious Next.js vulnerability disclosures in recent memory, given how widely the framework is deployed across startups, agencies, and enterprise platforms alike.
The advisory was published under the identifier GHSA vcvr r3jv pc5j, with the formal CVE record CVE-2026-94545 following shortly after. As is common with fast moving disclosures, some databases like NVD lagged behind the initial GitHub advisory in listing the record.
Which Versions Are Affected
The flaw affects Next.js 16.2.0 through 16.3.5 specifically when ImageResponse runs on the Node.js runtime, which is the default runtime for Next.js. It has also been patched separately in the 15.x line through version 15.5.26, though that release is considered hardening rather than a fix for an active remote code execution path. The Edge version of ImageResponse is not affected by this issue, and Next.js 15 was not vulnerable to the underlying RCE either.
If your application sits anywhere in the affected 16.x range, this Next.js vulnerability applies to you regardless of hosting provider, whether that is Vercel itself, Netlify, AWS, or a self managed server.
How the Vulnerability Works
ImageResponse relies on Satori, a Vercel library that converts image layout into SVG code before rendering the final PNG. The underlying issue traces back to how that SVG content is serialized. Next.js patched its compiled image generation implementation specifically to harden SVG serialization used by the ImageResponse feature.
In practical terms, the danger appears when a Next.js application takes values it does not control, such as a search parameter, a query string, or user submitted text, and places that value directly into SVG content, attributes, or styles during image generation. The advisory specifically calls out applications that pass attacker controlled values into SVG content, attributes, or styles during image generation as the ones at risk.
We are intentionally not publishing working exploit payloads here. If your team needs to verify exposure safely, that is exactly the kind of controlled testing a professional penetration test is built for, rather than something to attempt with public proof of concept code in a production environment.
Why This Next.js Vulnerability Is So Severe
Three factors make this particular flaw stand out among recent application security disclosures:
- It requires no authentication in many typical implementations, since ImageResponse routes are often public facing by design
- The impact is full remote code execution, not just information disclosure or denial of service
- ImageResponse is a common, everyday feature, used for something as ordinary as generating a preview thumbnail when a link is shared on social media
Because the underlying bug originates in Satori, its impact is magnified within the Next.js environment, potentially allowing an attacker to compromise the entire server running the application. This combination of low complexity, no authentication requirement, and maximum impact is exactly why CVSS scored this issue so close to the top of the scale.
Who Is at Risk
Applications that do not pass untrusted input into ImageResponse are not expected to be affected by this vulnerability. However, many teams do not realize how often request data ends up inside an OG image without a deliberate decision to put it there, such as pulling a page title, a username, or a query parameter straight into the generated graphic.
Sites hosted on platforms like Netlify are only affected if they actually use ImageResponse and the image it generates includes untrusted input such as text or an image pulled from the request. This is a good reminder that framework level risk is not always visible from infrastructure logs alone. A team can pass every cloud application security review at the hosting layer and still carry this exposure purely at the code level.
How to Fix It
- Check your installed Next.js version immediately. Confirm whether it falls within the affected 16.2.0 through 16.3.5 range.
- Upgrade to Next.js 16.3.6 or later, which contains the official fix.
- If you cannot upgrade right away, the advisory’s interim workaround is to keep attacker controlled values out of the SVG content, attributes, and styles that the Node.js ImageResponse feature renders.
- Audit every ImageResponse route in your codebase to identify anywhere request data reaches SVG output.
- Confirm the actual resolved package version, since Satori is bundled directly inside the Next.js package rather than listed separately in a lockfile, so a dependency check alone will not reveal your true exposure.
- Document the remediation in your vulnerability management report so the fix is traceable during a future audit or compliance review.
Vulnerability Management Lessons From This Incident
This incident is a reminder that framework level dependencies, not just your own application code, can introduce critical remote code execution risk. A team can write flawless business logic and still ship a Next.js vulnerability simply by using a default, widely recommended feature like ImageResponse in an ordinary way.
Mature vulnerability management does not stop at running a scanner once a quarter. It means tracking every framework and dependency your application relies on, subscribing to vendor security advisories, and having a defined process for triaging a critical disclosure the same day it is published, not the same month. Organizations working toward ISO 27001 vulnerability management requirements in particular need documented evidence of exactly this kind of rapid response process, since auditors increasingly ask for proof that a critical finding was addressed within a defined timeframe rather than simply noted.
Patch Management Best Practices for Framework Vulnerabilities
Framework vulnerabilities like this one move faster than most internal patch cycles are built to handle. A few practices help close that gap:
- Treat critical severity advisories from your core framework vendor as an exception to your normal patch management schedule, not something that waits for the next sprint
- Maintain a current inventory of every application built on Next.js, React, or other shared frameworks across your organization, since a single vulnerability can affect many projects at once
- Assign clear ownership for who actually applies the patch when a critical advisory drops outside business hours
- Test the patched version in staging quickly rather than deploying blind, since a rushed critical patch can occasionally introduce its own regressions
- Keep a rollback plan ready in case the patched version introduces unexpected breaking changes
Skipping these steps is exactly how a known, publicly patched CVE ends up being exploited months later, simply because no one owned the update.
Cloud Application Security Implications
Most Next.js applications today run in cloud environments, whether that is serverless functions, containerized deployments, or managed platforms. A remote code execution flaw in a server side rendering feature has outsized consequences in these environments, since a compromised function or container can potentially reach other cloud resources, environment variables, secrets, and internal APIs depending on how permissions are configured.
This is where cloud application security and traditional application security start to overlap heavily. Strong identity and access controls around your compute environment will not stop this vulnerability from being exploited, but they can meaningfully limit what an attacker gains afterward. Least privilege service roles, network segmentation between application tiers, and secrets management that avoids exposing credentials directly to application code are all practical controls that reduce blast radius when, not if, the next critical framework vulnerability appears.
Building a Vulnerability Management Dashboard for Faster Response
One recurring theme in incidents like this is that organizations often cannot answer a simple question quickly: which of our applications actually run the affected version. A well maintained vulnerability management dashboard solves exactly this problem by giving security and engineering teams a single, current view of:
- Every application and its current framework version
- Open critical and high severity advisories affecting those versions
- Patch status and time to remediation for past incidents
- Ownership assignments so nothing sits unpatched due to ambiguity
Teams without this kind of centralized visibility typically spend the first several hours of a critical disclosure like CVE-2026-94545 simply figuring out what they run, before remediation work has even started. That delay is often the single biggest factor separating organizations that patch within a day from those still exposed weeks later.
Frequently Asked Questions
What is CVE-2026-94545?
It is a critical Next.js vulnerability in the Node.js ImageResponse implementation that can allow remote code execution when attacker controlled values are rendered into SVG content, attributes, or styles.
Which Next.js versions are affected?
Versions 16.2.0 through versions before 16.3.6 on the Node.js runtime. The Edge runtime implementation is not affected.
What should I do right now?
Upgrade to Next.js 16.3.6 immediately. If an upgrade is not possible today, remove any attacker controlled input from SVG content, attributes, and styles used by ImageResponse.
Does this affect Next.js 15?
Next.js 15.x is not affected by the remote code execution issue, though 15.5.26 includes hardening related to the same underlying component.
Is this the same as other recent Next.js vulnerabilities?
No. This is a distinct issue from the earlier Image Optimization AVIF and libheif remote code execution flaw and from the separate Windows path traversal vulnerability reported around the same period.
How does this relate to zero day exploit risk?
This particular flaw was disclosed responsibly with a patch available on day one, so it does not meet the technical definition of a zero day exploit. However, the window between public disclosure and organizational patching is exactly when opportunistic attackers scan for unpatched targets, so speed still matters.
How can I confirm whether my application is actually exposed?
Manually reviewing every route that uses ImageResponse is a good start, but a professional security risk assessment is the most reliable way to confirm real world exposure across your entire application.
Should this incident change our broader application security strategy?
Yes. Incidents like this are a strong argument for regular web application penetration testing (VAPT) rather than relying only on vendor patch notes, since testing can surface how untrusted input actually flows through your specific implementation.
Get a Professional Security Assessment
Framework vulnerabilities like this Next.js vulnerability move fast, and patch notes alone will not tell you whether your specific implementation was ever exposed. If your team runs Next.js in production, now is the right time for a focused security review covering vulnerability management, patch management, and real world exploitability testing.
