CVE-2026-94545:

Critical NEXT.JS Flaw Allows Remote Code Execution Via Weaponized SVG File

Next.js CVE-2026-94545 can allow unauthenticated remote code execution through malicious SVG in ImageResponse.

CVE-2026-94545 is a critical flaw in the Node.js ImageResponse implementation of Next.js next/og, affecting versions 16.2.0 through releases before 16.3.6. If an application embeds attacker-controlled data in SVG elements, attributes, or styles, a remote unauthenticated attacker can trigger remote code execution during image generation. GitHub advisory GHSA-vcvr-r3jv-pc5j rates it Critical under CVSS v4. Edge ImageResponse deployments and applications that never place untrusted values in SVG content are not affected; the patched release is 16.3.6. Active exploitation is not reported.

Cyber Security NewsSep 23, 13:43 UTC · 3d agoVulnerability CVE-2026-94545

Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input

Vercel patched critical Next.js ImageResponse flaw CVE-2026-94545 (CVSS 9.5) allowing server code execution via crafted SVG input; no attacks reported yet.

Vercel disclosed CVE-2026-94545, a critical flaw (CVSS 9.5) in Next.js 16.2.0 through 16.3.5 where attacker-controlled values passed into ImageResponse on the Node.js runtime can reach Satori's SVG output unescaped and trigger code execution via downstream libraries. The fix is Next.js 16.3.6, with Satori 0.33.5 fixing the underlying bug and Next.js 15.5.26 adding hardening; the Edge runtime and Next.js 15 are unaffected. As of September 23 no public attacks or exploit code had been reported, and npm audit did not flag affected versions. Workaround: keep attacker-controlled values out of SVG content, attributes, and styles.

The Hacker NewsSep 23, 07:04 UTC · 4d agoVulnerability CVE-2026-94545

CVE-2026-94545

In the news2 stories

Critical NEXT.JS Flaw Allows Remote Code Execution Via Weaponized SVG File

Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input