Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input

A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said.

The risk applies when an app puts values an attacker controls, such as text read from the request URL, into the image. Vercel, which develops Next.js, fixed the flaw on September 22 in version 16.3.6.

The flaw, tracked as CVE-2026-94545, affects Next.js 16.2.0 through 16.3.5 when ImageResponse runs on the Node.js runtime, which Next.js uses by default. Vercel’s advisory rates it critical, with a CVSS score of 9.5. The Edge version of ImageResponse is not affected, and neither is Next.js 15.

ImageResponse uses Satori, a Vercel library, to convert the image layout into SVG code before the final PNG is generated. Affected apps are those that “pass attacker-controlled values into SVG content, attributes, or styles during image generation”, according to the advisory.

The advisory’s example takes a value from the request URL and places it inside an SVG title element. It does not say whether text in ordinary elements, such as a heading inside a div, also counts.

To find where an app uses the feature, look for ImageResponse imported from next/og, for example in route handlers and in opengraph-image files. Route handlers make the image when a request arrives. An opengraph-image file can make it at build time or when a request arrives.

As of September 23, The Hacker News found no public reports of attacks using the flaw and no public exploit code.

The fix is Next.js 16.3.6, the only patched version, installed with npm install next@16.3.6. As of September 23, the npm registry listed no fixed release for the 16.2 line, so apps on 16.2 need to move to 16.3.6. Next.js 15.5.26 adds extra security hardening for next/og on the 15.5 line.

If upgrading has to wait, the advisory’s workaround is to keep attacker-controlled values out of the SVG content, attributes, and styles that the Node.js ImageResponse renders. The advisory does not suggest switching to the unaffected Edge version, and the Next.js documentation marks the Edge runtime as deprecated.

In checks by The Hacker News on September 23, npm audit did not flag Next.js 16.3.5, an affected version. The advisory was also not yet listed in the GitHub Advisory Database, and no CVE record for CVE-2026-94545 had been published.

Check the Next.js version directly. Satori is bundled inside the Next.js package, so a lockfile does not list it as a dependency of Next.js.