Project
Open-source library that renders HTML and CSS into SVG or PNG images, powering Next.js's next/og Open Graph image generation feature.
SvelteKit OG 4.4 adds a client entry that renders OG images in the browser or a web worker, with no server request. A dev.to post says it targets live editor previews and adapter-static sites that have no server.
Reality
Satori, the JSX-to-SVG step behind Next.js next/og, put external input into SVG unescaped, per a dev.to explainer of CVE-2026-94545. The explainer says code execution would need the injected SVG to corrupt memory in a native parser, while SSRF needs only the injection.
Reality
Satori's SVG escaping flaw exposes Next.js 16.2.0 and every release before 16.3.6 to remote code execution when apps pass attacker input to next/og on Node. The step where app data becomes SVG markup needs the escaping discipline teams already give HTML and SQL.
Reality
Satori, the renderer behind next/og, cannot read WOFF2, so one Next.js site commits four Geist .ttf files to set its preview cards in the site's own type. The card takes its logo and palette from source, but its font is a second copy that someone has to keep current.
Reality
CVE-2026-94545 lets attacker-supplied text in an Open Graph image reach Next.js dependencies. Vercel shipped the fix on September 22 in 16.3.6; a day later, npm audit still passed affected builds.
Reality
A Korean saju service found that satori's HTML/CSS subset gives out at the hanja well before it gives out at Latin text. The fix was a two-face fallback array plus a module-level cache for two 2 MB TTFs.
Reality
A Next.js file convention generated eleven locale routes that had never returned a 200. The only monitor that noticed was Google's crawler, and it had only tried one of them.
Reality