Satori (Product): news timeline & CVEs

Next.js ImageResponse Vulnerability Lets Remote Attackers Execute Code Through SVG Content

Unauthenticated attackers can execute code on Next.js 16.2.0–16.3.5 servers via crafted SVG in ImageResponse.

A flaw tracked as GHSA-vcvr-r3jv-pc5j in Next.js ImageResponse can let unauthenticated remote attackers execute code by supplying crafted values that are rendered into SVG. It affects the Node.js next/og path in versions 16.2.0 through 16.3.5 when untrusted input reaches SVG content, attributes, or styles via Satori. Vercel released Next.js 16.3.6, with 15.5.26 as related hardening for the 15.x line, and Satori 0.33.5 includes the library fix. Edge ImageResponse and applications that never insert attacker-controlled data are out of scope, and the report does not cite in-the-wild exploitation.

GBHackersOct 1, 13:08 UTC · 7d agoVulnerability 2 sources

Node.js ImageResponse Implementation Vulnerability Enables Remote Code Execution

Next.js 16.2.0–16.3.5 Node.js ImageResponse can allow RCE via unsanitized SVG input; fixed in 16.3.6.

GitHub advisory GHSA-vcvr-r3jv-pc5j says Next.js 16.2.0 through 16.3.5 can allow remote code execution when the Node.js next/og ImageResponse implementation inserts attacker-controlled data into SVG content, attributes, or styles. The Edge implementation is not affected. The issue comes from Satori 0.0.27 through 0.33.4, tracked as CVE-2026-94545 and patched in Satori 0.33.5; Next.js 16.3.6 includes the fix. GitHub rated it critical under CVSS v4 for unauthenticated network exploitation, and no in-the-wild exploitation is reported.

Cyber Security NewsOct 1, 12:59 UTC · 7d agoVulnerability 2 sources CVE-2026-94545

Satori

Timeline2 articles

Related CVEsby mentions

Appears with

Next.js ImageResponse Vulnerability Lets Remote Attackers Execute Code Through SVG Content

Node.js ImageResponse Implementation Vulnerability Enables Remote Code Execution