Next.js 16.3.6 Fixes Critical ImageResponse Code Execution Flaw

Vercel has released Next.js 16.3.6 to fix a critical security flaw in the framework's ImageResponse feature, which websites use to create Open Graph and other social preview images, the pictures that appear when a link is shared on social media or in chat apps. The vulnerability, tracked as CVE-2026-94545, can allow an attacker to run code on a server when an application puts attacker-controlled values, for example text read from a request URL, into the image generation process. Vercel, the company that maintains Next.js, announced the fix on September 22 and rates the issue critical with a CVSS (Common Vulnerability Scoring System) score of 9.5.

The vulnerable versions are Next.js 16.2.0 through 16.3.5 when ImageResponse runs on the Node.js runtime, which is the default server-side JavaScript environment in Next.js. The Edge version of ImageResponse is not affected, and Next.js 15 is also not affected. ImageResponse uses a library called Satori, also developed by Vercel, to convert the image layout into SVG (Scalable Vector Graphics, a text-based image format) before the final PNG image is created. According to Vercel's advisory, the flaw affects apps that pass attacker-controlled values into SVG content, attributes, or styles during image generation. The advisory's example takes a value from a request URL and places it inside an SVG title element. It does not say whether text in ordinary elements, such as a heading inside a div, also counts.

To find where an application uses the feature, developers should look for ImageResponse imported from next/og, for example in route handlers and in opengraph-image files. Route handlers create the image when a request arrives, while an opengraph-image file can create it either at build time or when a request arrives. As of September 23, The Hacker News reported that it found no public reports of attacks exploiting this flaw and no public exploit code.

The only patched version is Next.js 16.3.6, which can be installed with npm install next@16.3.6. As of September 23, the npm registry had no fixed release for the 16.2 line, so sites on 16.2 need to move to 16.3.6. Next.js 15.5.26 adds extra security hardening for next/og on the 15.5 line. If upgrading has to wait, the advisory's workaround is to keep attacker-controlled values out of the SVG content, attributes, and styles that the Node.js ImageResponse renders. The advisory does not suggest switching to the unaffected Edge version, and the Next.js documentation marks the Edge runtime as deprecated.

The checks by The Hacker News on September 23 also showed some detection gaps. The npm audit tool did not flag Next.js 16.3.5, an affected version. The advisory was not yet listed in the GitHub Advisory Database, and no CVE record for CVE-2026-94545 had been published at that time. Vercel's advisory and announcement also provide no way to check whether an affected route was abused before the patch, and they do not say whether apps hosted on Vercel are protected. For two critical Next.js flaws fixed in August, the company said hosted apps were protected and needed no upgrade, but no such statement appears for this flaw. Affected versions have been available since Next.js 16.2 was released on March 18.

The bug itself is in Satori, and Satori's own advisory, published the same day, says certain values reached its SVG output without being properly escaped. A specially made value could then be read as SVG code instead of plain text. In Next.js, such values could reach vulnerabilities in other libraries that Next.js depends on and lead to code execution, Vercel said. Vercel has not named those libraries. Satori's advisory rates the same CVE as moderate, with a score of 5.3, and says the impact depends on how the SVG output is used. Developers who use Satori directly should update it to version 0.33.5, which contains the fix.

Because Satori is bundled inside the Next.js package, it does not appear as a separate dependency in a project's lockfile, so relying on a dependency scanner may miss it. Vercel recommends checking the Next.js version directly. For teams managing many JavaScript applications, AEU-I offers security-first IT and consulting that can help with patch planning and dependency reviews.