Crafted Open Graph text can reach code execution in Next.js 16.2 through 16.3.5
CVE-2026-94545 lets attacker-supplied text in an Open Graph image reach Next.js dependencies. Vercel shipped the fix on September 22 in 16.3.6; a day later, npm audit still passed affected builds.
The Watch · Security desk
What happened
- Vercel fixed CVE-2026-94545 on September 22 in Next.js 16.3.6; it affects 16.2.0 through 16.3.5 when ImageResponse renders on the Node.js runtime, which Next.js uses by default.
- The bug sits in Satori, the Vercel library that turns an image layout into SVG, which let certain values through unescaped so a crafted string is read as SVG code instead of plain text.
- Vercel said those values can then reach vulnerabilities in other libraries Next.js depends on and lead to code execution, without naming the libraries.
- Vercel's advisory rates the flaw critical at CVSS 9.5, while Satori's advisory, published the same day, rates the same CVE moderate at 5.3.
- As of September 23, The Hacker News had turned up no public reports of attacks using the flaw and no public exploit code.
Why it matters
- What it limits constraint Scanner-driven triage will not queue this one, so each team has to read its own Next.js version before it can say whether it is exposed.
- Who's exposed exposure The upgrade closes the path. It leaves the incident question open: no published method exists for telling whether an affected route was hit before September 22.
- Who has to decide decision Edge ImageResponse is unaffected but the Edge runtime is deprecated in the Next.js docs, so the practical options are 16.3.6 or removing attacker input from the image.
- What doesn't add up contradiction In August Vercel told customers its own hosting protected them from two critical Next.js flaws; teams on that hosting are now on the same upgrade clock as self-hosted ones.
Next story · Security · Oct 6
Malicious indexed-btree package moves npm malware from install scripts to first useConfirmed2 publishers
The two ratings measure different things. Satori's advisory scores the escaping failure in its own output at 5.3 and says the impact depends on how that SVG is used [18]. Vercel scores the chain at 9.5, because the code consuming that SVG inside a Next.js app is Next.js, and Vercel says the injected values can reach vulnerabilities in libraries it depends on [17][19]. The spread between the two numbers is 4.2 points on one CVE [29]. Apps on the default Node runtime fall under Vercel's scenario [2].
What is exploitable depends on where the attacker's string lands. Vercel's condition is apps that "pass attacker-controlled values into SVG content, attributes, or styles during image generation" [4]. The worked example takes a value from the request URL and places it inside an SVG title element, so one request to a route that renders URL text into an image is the whole setup [5]. On text in ordinary elements, such as a heading inside a div, the advisory is silent [5]. Until that is settled, any request-derived string reaching next/og has to be treated as in scope, in route handlers and in opengraph-image files [12].
In checks by The Hacker News on September 23, npm audit did not flag Next.js 16.3.5, the advisory had not appeared in the GitHub Advisory Database, and no CVE record for CVE-2026-94545 had been published [9][10]. Satori ships bundled inside the Next.js package, so it does not show up in a lockfile as a Next.js dependency [11]; the Next.js version is what a team has to read [15].
Affected builds have been installable since 16.2 shipped on March 18, which is 188 days before the September 22 patch [26][16][28].
16.3.6 is the only patched release. Apps pinned to 16.2 take a minor version bump to get the fix, because as of September 23 the npm registry listed no fixed build on the 16.2 line [21]. Next.js 15 is not affected, and 15.5.26 adds extra hardening for next/og on that line [6][22]. Teams calling Satori directly need 0.33.5 [27]. Where an upgrade has to wait, Vercel's workaround is to keep attacker-controlled values out of the SVG content, attributes, and styles that the Node.js ImageResponse renders [8].
What to watch
- Whether Vercel states that apps on its own hosting were protected, as it did for the two critical Next.js flaws fixed in August.
- Publication of the CVE record and a GitHub Advisory Database entry, which would let dependency scanners surface affected versions.
- Any clarification of whether attacker text in ordinary elements, not just an SVG title element, is exploitable, and any public exploit code.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+20
- Incentives35
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, Vercel said.
- [2]
CVE-2026-94545 affects Next.js 16.2.0 through 16.3.5 when ImageResponse runs on the Node.js runtime, which Next.js uses by default.
- [3]
The bug is in Satori; Satori's advisory says certain values reached its SVG output without being properly escaped, and a specially made value could then be read as SVG code instead of plain text.
- [4]
Affected apps are those that "pass attacker-controlled values into SVG content, attributes, or styles during image generation", according to the advisory.
- [5]
The advisory's example takes a value from the request URL and places it inside an SVG title element; it does not say whether text in ordinary elements, such as a heading inside a div, also counts.
- [6]
The Edge version of ImageResponse is not affected, and neither is Next.js 15.
- [7]
The advisory does not suggest switching to the unaffected Edge version, and the Next.js documentation marks the Edge runtime as deprecated.
- [8]
The advisory's workaround is to keep attacker-controlled values out of the SVG content, attributes, and styles that the Node.js ImageResponse renders.
- [9]
In checks by The Hacker News on September 23, npm audit did not flag Next.js 16.3.5, an affected version.
- [10]
As of September 23 the advisory was not yet listed in the GitHub Advisory Database, and no CVE record for CVE-2026-94545 had been published.
- [11]
Satori is bundled inside the Next.js package, so a lockfile does not list it as a dependency of Next.js.
- [12]
To find where an app uses the feature, look for ImageResponse imported from next/og, for example in route handlers and in opengraph-image files.
- [13]
ImageResponse uses Satori, a Vercel library, to convert the image layout into SVG code before the final PNG is generated.
- [14]
ImageResponse is the Next.js feature that generates Open Graph and other social preview images.
- [15]
The Hacker News advises checking the Next.js version directly.
- [16]
Vercel fixed the flaw on September 22 in Next.js version 16.3.6.
- [17]
Vercel's advisory rates the flaw critical, with a CVSS score of 9.5.
- [18]
Satori's advisory, published the same day, rates the same CVE as moderate, with a score of 5.3, and says the impact depends on how the SVG output is used.
- [19]
In Next.js, such values could reach vulnerabilities in other libraries that Next.js depends on and lead to code execution, Vercel said; it has not named those libraries.
- [20]
As of September 23, The Hacker News found no public reports of attacks using the flaw and no public exploit code.
- [21]
Next.js 16.3.6 is the only patched version; as of September 23 the npm registry listed no fixed release for the 16.2 line, so apps on 16.2 need to move to 16.3.6.
- [22]
Next.js 15.5.26 adds extra security hardening for next/og on the 15.5 line.
- [23]
Vercel's advisory and announcement do not say whether apps hosted on Vercel are protected.
- [24]
For two critical Next.js flaws fixed in August, Vercel said hosted apps were protected and needed no upgrade.
- [25]
Vercel's advisory and announcement provide no way to check whether an affected route was abused before the patch.
- [26]
Affected versions have been available since Next.js 16.2 was released on March 18.
- [27]
Developers who use Satori directly should update it to version 0.33.5, which has the fix.
- [28]
March 18 to September 22 is 188 days of exposure while affected versions were available.
- [29]
The gap between Vercel's rating and Satori's rating of the same CVE is 4.2 CVSS points.
Sources
2 independent publishers whose own reporting we read for this story.