Originally published at HOL
BREAKING: CVE-2026-94545 Next.js next/og ImageResponse RCE (GHSA-vcvr-r3jv-pc5j)
Vercel published an out-of-band Next.js security update on 2026-09-22. The Critical path is remote code execution in the Node.js ImageResponse implementation from next/og (CVE-2026-94545 / GHSA-vcvr-r3jv-pc5j, CVSS 9.5). It comes from improper SVG escaping in upstream Satori (GHSA-wx4j-mvgx-mqwp), which Next.js pulls in for OG image generation. Patched Next.js is 16.3.6. Next.js 15.x is not affected by the RCE; 15.5.26 is hardening only. GitHub now lists CVE-2026-94545 on GHSA-vcvr-r3jv-pc5j (NVD and cve.org still empty at patch time). This is the operator write-up from the Next.js blog and the GitHub advisories.
Who is not in scope
Skip the pager if any of these hold:
- You already run
next@16.3.6or newer on the 16.x train. - The app is on Next.js 15.x for the RCE itself. The September 22 cut still ships
15.5.26as related hardening, but the vendor states 15.x is not affected by this remote code execution issue. - You use only the Edge
ImageResponseimplementation. Edge is not affected. - Your Node.js
ImageResponsehandlers never pass attacker-controlled values into SVG content, attributes, or styles during image generation.
If a public OG route takes a query param, header, or other request field and drops it into JSX/SVG that ImageResponse renders on Node, treat yourself as in scope until you patch.
What broke
Next.js Node.js ImageResponse RCE (CVE-2026-94545 / GHSA-vcvr-r3jv-pc5j). Affected next versions are >= 16.2.0 and < 16.3.6. The Node.js path from next/og is vulnerable when attacker-controlled values reach SVG content, attributes, or styles. The advisory example wires a searchParams value into an SVG <title> inside ImageResponse. Under those conditions, improper escaping in Satori-generated SVG can lead to remote code execution through other upstream dependencies. The Next.js fix upgrades those dependencies. Severity on the GHSA is Critical 9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). Credit: KarimPwnz.
Upstream Satori improper SVG escaping (GHSA-wx4j-mvgx-mqwp). Satori versions >= 0.0.27 and < 0.33.5 do not properly escape certain values before including them in generated SVG. Crafted values can be interpreted as SVG markup. Impact depends on how the SVG is consumed. Patched Satori is 0.33.5. Severity is Moderate 5.3. For Next.js apps, do not chase a standalone Satori bump as the product fix; install the patched Next.js release that vendors the upgrade.
Confirmed on the npm registry today: next@16.3.6 and next@15.5.26 both resolve. The Next.js September 22, 2026 security update blog is live (no longer Upcoming). No matching Vercel changelog entry was present at publish time; use the Next.js blog and the two GHSAs as primary records.
What this is not
This is not the August 2026 Image Optimization AVIF / libheif RCE (GHSA-2xp9-vwfh-vxw4). It is not CVE-2026-75604, the Windows path-traversal RCE that needed both routers without Cache Components. It is not automatic RCE on every next/og use: Edge ImageResponse is out, and Node handlers that never feed attacker-controlled values into SVG content, attributes, or styles are out. CVE ID CVE-2026-94545 is now on the GHSA page; NVD and the CVE.org record may still lag. We are not inventing the ID. We are not claiming CISA KEV listing or in-the-wild exploitation; that status is unknown from the primary sources.
How to check
Confirm the next package the running process actually loaded:
npx next --version
# or
npm ls next
On the 16.x train, anything >= 16.2.0 and below 16.3.6 is in the RCE window. Then inventory Node.js OG routes that take request input into SVG:
# look for Node ImageResponse from next/og (not Edge-only handlers)
rg -n "from ['\"]next/og['\"]|ImageResponse" app pages src --glob '*.{js,jsx,ts,tsx}'
# then check whether searchParams, headers, cookies, or body fields land in SVG props/children/styles
If that path exists and you are still below 16.3.6, patch before you argue about whether the values are "really" attacker-controlled.
How to fix
npm install next@16.3.6 # 16.x Active LTS (RCE fix)
npm install next@15.5.26 # 15.x Maintenance LTS (hardening only; 15.x not affected by the RCE)
If you cannot upgrade immediately, the GHSA workaround is: do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation from next/og. That is a temporary constraint, not a substitute for 16.3.6 on affected 16.x apps.
HOL Guard does not have a source record for GHSA-vcvr-r3jv-pc5j yet (the Guard CVE evidence pack 404s today). Use the Next.js September 22, 2026 security update and the GitHub advisories as the primary records until Guard ingests it.
