Critical Next.js flaw: server code execution via a crafted SVG

Vercel has warned of a critical vulnerability in the popular Next.js framework. The issue lies in the ImageResponse feature, which generates images for Open Graph and other social previews. If an app feeds attacker-controlled data into such an image — for instance, text read from the request URL — the attacker can achieve arbitrary code execution on the server.

Who is affected

The flaw is tracked as CVE-2026-94545 and rated critical with a CVSS score of 9.5. It affects Next.js 16.2.0 through 16.3.5 when ImageResponse runs on the Node.js runtime, which is the default. The Edge version of the feature is not affected, and neither is the Next.js 15 line.

Under the hood, ImageResponse uses a Vercel library called Satori, which first converts the image layout into SVG code before producing the final PNG. According to the advisory, apps at risk are those that pass attacker-controlled values into SVG content, attributes, or styles. The advisory's example places a value from the request URL inside an SVG title element; it does not say whether text in ordinary elements, such as a heading inside a div, also counts.

To find where the feature is used, look for ImageResponse imported from next/og — in route handlers and in opengraph-image files.

Fix and workaround

Vercel patched the flaw on September 22 in version 16.3.6 — as of September 23, the only fixed release. There is no separate fix in the npm registry for the 16.2 line, so those apps need to move to 16.3.6. Version 15.5.26 adds extra hardening for next/og.

If upgrading has to wait, the recommendation is simply to keep externally controlled values out of the SVG content, attributes, and styles. The advisory does not suggest switching to the Edge version — the Next.js docs mark the Edge runtime as deprecated.

Detection caveats

In checks by The Hacker News on September 23, npm audit did not flag the affected 16.3.5, the advisory was not yet in the GitHub Advisory Database, and no CVE record had been published. Check the Next.js version directly: Satori is bundled inside the Next.js package, so a lockfile does not list it as a dependency.

The bug itself is in Satori: per its own advisory, certain values reached the SVG output without being properly escaped and could be read as code rather than plain text. Satori rates the same CVE only as moderate (5.3), since the impact depends on how the SVG is used. Developers using Satori directly should update to version 0.33.5.

As of September 23, there were no public reports of attacks and no public exploit code. Vercel does not say whether apps hosted on its platform are protected, nor does it offer a way to check whether an affected route was abused before the patch.

Source: The Hacker News