Critical NEXT.JS Flaw Allows Remote Code Execution Via Weaponized SVG File
Next.js CVE-2026-94545 can allow unauthenticated remote code execution through malicious SVG in ImageResponse.
CVE-2026-94545 is a critical flaw in the Node.js ImageResponse implementation of Next.js next/og, affecting versions 16.2.0 through releases before 16.3.6. If an application embeds attacker-controlled data in SVG elements, attributes, or styles, a remote unauthenticated attacker can trigger remote code execution during image generation. GitHub advisory GHSA-vcvr-r3jv-pc5j rates it Critical under CVSS v4. Edge ImageResponse deployments and applications that never place untrusted values in SVG content are not affected; the patched release is 16.3.6. Active exploitation is not reported.
- CVE-2026-94545 affects Node.js ImageResponse in the next/og package.
- Versions 16.2.0 before 16.3.6 are affected; 16.3.6 is the fix.
- Unauthenticated network attack via attacker-controlled SVG can yield RCE.
- Edge ImageResponse and apps without untrusted SVG input are unaffected.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94545 | Improper Output Escaping in Satori SVG Generator Exposes Next.js OG Image Pipelines | 5.3 | 1% | PoC ×5 |
From the original article
2 min read at cybersecuritynews.com
A critical Next. js vulnerability, tracked as CVE-2026-94545, affects the Node. js ImageResponse implementation in the next/og package and could allow remote code execution by exploiting malicious SVG content during image generation.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.