Next.js 16.3.6 Fixes CVE-2026-94545: ImageResponse RCE Scope and Remediation
Next.js 16.3.6, released September 22, 2026, fixes CVE-2026-94545, a critical remote-code-execution vulnerability in the Node.js implementation of ImageResponse from next/og. The official Next.js advisory rates the issue at CVSS 9.5 and lists Next.js versions from 16.2.0 up to, but excluding, 16.3.6 as affected.
Exposure depends on application behavior. The vulnerable path is reached when the Node.js ImageResponse implementation renders attacker-controlled values into SVG content, attributes or styles. Next.js applications using the Edge ImageResponse implementation fall outside the affected path, and Next.js 15.x is outside the RCE version range.
Operators running an affected Next.js 16 release should upgrade to 16.3.6 or later and redeploy. Vercel also released Next.js 15.5.26 with related hardening, while explicitly stating that the 15.x line is not affected by this remote-code-execution issue.
Affected and fixed versions
| Deployment | CVE-2026-94545 status | Action |
|---|---|---|
Next.js >=16.2.0 <16.3.6, Node.js ImageResponse, attacker-controlled SVG values |
Affected | Upgrade to 16.3.6 or later |
| Next.js 16.3.6 or later | Patched for this issue | Redeploy on the patched version |
| Next.js 15.x | Outside the RCE affected range | 15.5.26 adds related hardening |
Edge ImageResponse |
Outside the affected implementation | Verify the deployed runtime |
The affected range comes from the Next.js security advisory, which lists >=16.2.0 <16.3.6; the patched version is 16.3.6.
Where the RCE condition appears
ImageResponse is commonly used to generate Open Graph and other social-preview images. The vulnerable Next.js path uses Satori to generate SVG output. Satori's upstream advisory says versions from 0.0.27 through versions before 0.33.5 can improperly escape certain values, allowing crafted data to be interpreted as SVG markup.
In the Next.js context, Vercel says the resulting SVG can interact with other upstream dependencies in a way that leads to remote code execution. The Next.js advisory identifies the material application prerequisite: attacker-controlled values must reach SVG content, attributes or styles during image generation.
A practical audit should therefore locate imports of ImageResponse from next/og, identify routes that run it on the Node.js runtime, and trace request-derived values used in generated image markup or styling. Dynamic Open Graph routes that build image content from query parameters, slugs, user profiles or other externally controlled data deserve particular attention.
Remediation
For the current 16.x line, install Next.js 16.3.6 or a later fixed release and redeploy the application:
npm install [email protected]
Teams pinned to the 15.5 maintenance line can install 15.5.26 for the related hardening update. That release is defense-in-depth for this issue; Vercel's advisory places the RCE affected range only in Next.js 16.2.0 through 16.3.5.
When an immediate upgrade is temporarily blocked, the official workaround is to keep attacker-controlled values out of SVG content, attributes and styles rendered by the Node.js ImageResponse implementation. This is a temporary exposure-reduction measure; upgrading remains the primary remediation.
Direct Satori users should also review the upstream advisory. Satori lists versions >=0.0.27 <0.33.5 as affected and 0.33.5 as patched.
How to triage a Next.js deployment
Start with the deployed next version rather than a development workstation or an unbuilt branch. Confirm that the production lockfile and runtime contain 16.3.6 or later if the application is on Next.js 16.
Then search the application for ImageResponse and next/og. For each route, determine whether it executes on Node.js or Edge and whether request-controlled data can reach generated SVG text, attributes or styles. This separates deployments that match the advisory's RCE conditions from installations that merely contain the framework package.
Redeploy after upgrading so production functions, containers and preview environments stop serving the vulnerable dependency set. Long-lived preview or branch deployments should be included in the inventory when they remain publicly reachable.
Severity and exploitation status
The Next.js advisory classifies CVE-2026-94545 as Critical with a CVSS 4.0 score of 9.5. Its vector records network reachability, low attack complexity, no required privileges and no user interaction, with attack requirements present because exploitation depends on the vulnerable application path and input flow.
The upstream Satori issue has a different severity assessment because its direct impact is improper SVG escaping and depends on how generated SVG is consumed. Next.js assigns the higher application-level severity because its affected Node.js processing chain can turn that condition into server-side code execution.
As of September 23, independent reporting had found no public reports of exploitation or public exploit code. The remediation priority follows from the critical server-side impact and the availability of a fixed Next.js release.
Bottom line
Next.js 16 applications should move to 16.3.6 or later. The highest-priority exposure is a Node.js ImageResponse route that renders attacker-controlled values into SVG content, attributes or styles. Version verification plus a targeted next/og code audit gives operators a direct way to identify affected routes while the framework upgrade removes the vulnerable dependency chain.
Sources
- Next.js — September 22 security update: https://nextjs.org/blog/nextjs-security-update-september-22-2026
- Next.js advisory GHSA-vcvr-r3jv-pc5j / CVE-2026-94545: https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j
- Satori advisory GHSA-wx4j-mvgx-mqwp: https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp
- The Hacker News — independent September 23 coverage: https://thehackernews.com/2026/09/critical-nextjs-imageresponse-flaw-can.html