Vercel Patches Critical Next.js ImageResponse RCE Flaw (CVE-2026-94545)

Critical Next.js ImageResponse Flaw Enables Server-Side Code Execution

1. What the vulnerability is and why it matters

• Vercel disclosed CVE-2026-94545 on Sep 22 2026. The flaw lives in the ImageResponse API (next/og) that generates Open Graph preview images.
• ImageResponse relies on Vercel’s Satori library to turn a JSX-like layout into SVG, then rasterises it to PNG.
• When an application injects attacker-controlled strings (e.g., a URL segment) into the SVG – such as a <title> element – Satori fails to escape the payload. The malformed SVG is parsed as code, allowing arbitrary JavaScript execution in the Node.js process.
• Vercel rates the issue Critical with a CVSS 9.5, because successful exploitation yields remote code execution (RCE) on the server hosting the Next.js app.

2. Affected stacks and version matrix

• Vulnerable range: Next.js 16.2.0 – 16.3.5 (Node.js runtime).
• Patched version: Next.js 16.3.6 (released Sep 22 2026).
• Unaffected: Edge runtime of ImageResponse, all Next.js 15.x releases, and any app that does not use ImageResponse at all.
• Satori dependency: Bundled inside Next.js; separate Satori 0.33.5 fixes the underlying SVG escaping bug (moderate CVSS 5.3).

3. Exploit mechanics in practice

• An attacker crafts a request URL like https://example.com/api/og?title=%3Csvg%20onload%3D%22alert(1)%22%3E.
• The Next.js route handler imports ImageResponse from next/og and passes params.title directly into the SVG layout.
• Satori renders the raw string into the <title> node without sanitisation. When the rasteriser processes the SVG, the embedded JavaScript runs in the Node.js context, giving the attacker the same privileges as the Next.js process.
• Because the Node.js runtime often runs with filesystem and network access, the attacker can read environment variables, write files, or pivot to other services.

4. Detection and current exposure

• The Hacker News reported no public exploits or active abuse as of Sep 23 2026.
• npm audit did not flag versions 16.3.5, indicating the advisory was not yet in the npm advisory database.
• The CVE entry appears in the NVD CVE records (Sponsored).
• No GitHub Advisory entry existed at the time of reporting, so automated tooling may miss the issue.

5. Immediate remediation steps

1. Upgrade: Run npm install next@16.3.6 (or later) on all production environments. The patch is the only official fix for the vulnerable range.
2. Lockfile verification: Ensure the bundled Satori version is >= 0.33.5 by inspecting node_modules/next/package.json.
3. Temporary mitigation: Audit all ImageResponse calls. Remove any direct interpolation of request data into SVG markup. Prefer server-side sanitisation libraries (e.g., DOMPurify) before passing values to Satori.
4. Edge fallback: If you cannot upgrade, migrate the route to the Edge runtime (runtime: 'edge') – note that Vercel has deprecated Edge for next/og, so this is a short-term stop-gap only.
5. Monitoring: Add logging around ImageResponse handlers to capture unexpected payload sizes or characters that could indicate probing attempts.

6. Broader impact on the Next.js ecosystem

• The flaw highlights a supply-chain risk: a low-level rendering library (Satori) can compromise the entire framework when its output is consumed without validation.
• Projects that embed Next.js as a dependency (e.g., headless CMS platforms, SaaS dashboards) must verify their own lockfiles and may need to push emergency patches to downstream customers.
• Vercel’s statement that hosted apps were automatically protected for earlier Next.js flaws suggests they may have applied a runtime guard for this issue, but the advisory does not confirm it. Operators on Vercel should still verify the deployed version via the dashboard.

7. What to watch next

• Exploit code emergence: Given the high CVSS, threat actors are likely to develop PoC scripts. Watch GitHub and underground forums for payload samples.
• Library cascade: Vercel hinted that the malicious SVG could trigger vulnerabilities in other downstream libraries. Security teams should audit any native modules that process SVG or PNG data (e.g., sharp, canvas).
• Regulatory scrutiny: A remote code execution flaw in a widely used web framework may attract attention from data-protection regulators, especially if exploited against sites handling personal data.
• Future hardening: Next.js 15.5.26 introduced extra sanitisation for next/og. Expect similar mitigations to be back-ported to the 16.x line in subsequent releases.

8. External references

• The original advisory and technical details are documented on Thehackernews.
• For a comparable supply-chain SVG issue, see the Satori advisory (moderate CVSS 5.3).
• Additional context on Node.js runtime risks can be found in the OWASP Node.js Security Cheat Sheet.

9. Bottom line for operators

• Upgrade now: The patch is available and inexpensive to apply.
• Sanitise inputs: Never trust user-derived strings when generating SVG via ImageResponse.
• Audit your stack: Verify that no other bundled libraries inherit the same unescaped SVG path.
• Stay alert: Monitor security feeds for emerging exploit kits targeting CVE-2026-94545.

Sponsored: For detailed vulnerability metadata, consult the NVD CVE records.

Related coverage

• Cisco 0-Day Vulnerability Exposes Users to Remote Exploitation
• WordPress Click2Shell vulnerability Enables Forced Theme Install and Remote Code Execution
• JFrog Researchers Expose Critical Bifrost AI Gateway RCE Due to Default-Disabled Auth

Explore more on this topic

• More nextjs coverage