Cybersecurity
Next.js ImageResponse flaw enables server code execution
Vercel said a vulnerability in Next.js ImageResponse affected versions 16.2.0 through 16.3.5 on Node.js, could lead to server code execution through attacker-controlled SVG input, and was fixed in 16.3.6.
- Vercel said CVE-2026-94545 could let attacker-controlled values in Next.js ImageResponse lead to server code execution.
- The flaw affected Next.js 16.2.0 through 16.3.5 when ImageResponse ran on the Node.js runtime, and it did not affect the Edge version or Next.js 15.
- Vercel fixed the issue in Next.js 16.3.6 on 22 September and told developers to keep attacker-controlled values out of SVG content, attributes and styles if they could not upgrade.
- Satori, the library used by ImageResponse, published a same-day advisory that said some values reached SVG output without proper escaping and told direct users to update to version 0.33.5.
- On 23 September, the article said there were no public reports of attacks or exploit code, and no CVE record or GitHub Advisory Database entry had been published yet.
Vercel said a flaw in Next.js ImageResponse could let attacker-controlled data reach SVG output and lead to code execution on a server. It identified the issue as CVE-2026-94545 and said it affected versions 16.2.0 through 16.3.5 when the Node.js runtime handled the feature.
ImageResponse used Satori to turn a layout into SVG before PNG generation. Vercel said affected applications were those that passed attacker-controlled values into SVG content, attributes or styles, and its example placed a request URL value inside an SVG title element.
Vercel fixed the flaw in 16.3.6 on 22 September. It said the Edge version of ImageResponse and Next.js 15 were not affected, and it advised developers who could not upgrade to keep attacker-controlled values out of the rendered SVG.
The article said it found no public reports of attacks or exploit code by 23 September. It also said Satori had issued its own advisory on the same day, described missing escaping in SVG output, and gave the issue a 5.3 score as moderate for users of Satori directly.
Named in this story
Companies
- Vercel
- company that developed Next.js and issued the advisory
Products and systems
- Next.js
- framework affected by the flaw
- ImageResponse
- feature used to generate social preview images
- Satori
- library that turned the image layout into SVG
- Node.js runtime
- default runtime where the flaw applied
How the source tells it
The piece was mostly a factual security notice, with urgency coming from the critical rating and code-execution framing rather than from sensational language.
- urgency a critical score and patch guidance pressed for quick action
- threat server code execution language and attacker-controlled input framed the flaw as a direct compromise path