NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

#cve-2026-94545

0 stories this week · 0 this month · 2 in 6 months · mostly security

Stories per day · 30 days

2 stories, newest first · one card per story

Cyber Security NewsOct 1, 2026high

Node.js ImageResponse Implementation Vulnerability Enables Remote Code Execution

Next.js 16.2.0–16.3.5 Node.js ImageResponse can allow RCE via unsanitized SVG input; fixed in 16.3.6.

2 sources3 min readnext.js satori

6

Cyber Security NewsSep 23, 2026high

Critical NEXT.JS Flaw Allows Remote Code Execution Via Weaponized SVG File

Next.js CVE-2026-94545 can allow unauthenticated remote code execution through malicious SVG in ImageResponse.

3 min readnext.js cve-2026-94545

2