CVE-2026-94545: Critical Next.js ImageResponse Flaw Enables Remote Code Execution

A critical vulnerability in Next.js could allow remote attackers to execute arbitrary code on vulnerable servers through the framework’s ImageResponse functionality. Tracked as CVE-2026-94545, the flaw affects the Node.js implementation of ImageResponse in next/og and carries a CVSS score of 9.5. Vercel addressed the issue on September 22, 2026, with the release of Next.js 16.3.6.

The vulnerability becomes exploitable when an application places attacker-controlled input into SVG content, attributes, or styles during server-side image generation. Under these conditions, specially crafted values can reach the SVG rendering pipeline in a way that may ultimately result in remote code execution on the application server.

The issue is particularly relevant because ImageResponse is commonly used to dynamically generate Open Graph images, social media previews, and other server-rendered graphics based on application or user data. Applications that incorporate URL parameters, API data, form input, or other untrusted values into these images should be reviewed immediately.

Security teams looking for CVE-2026-94545 detection content can leverage SOC Prime’s AI-Native Detection Intelligence Platform to identify suspicious exploitation and post-compromise behavior associated with vulnerable web applications.

Security engineers can also use Uncoder AI to transform vulnerability intelligence into detection logic, generate hunting queries, convert indicators into platform-specific searches, and accelerate detection engineering for emerging vulnerabilities.

Contact Sales

CVE-2026-94545 analysis

CVE-2026-94545 is a critical remote code execution vulnerability affecting the Node.js ImageResponse implementation included in the next/og package. Vercel’s advisory assigns the vulnerability a CVSS v4 score of 9.5, with network-based exploitation, low attack complexity, no authentication requirement, and no required user interaction.

The affected functionality relies on Satori, Vercel’s library for converting JSX and HTML-like structures into SVG content before the resulting image is rendered. According to the published research, certain attacker-controlled values could reach generated SVG output without being properly escaped. As a result, specially crafted input may be interpreted as SVG markup rather than harmless text. In affected Next.js configurations, this behavior can interact with downstream components in a way that leads to server-side code execution.

CVE-2026-94545 affects Next.js versions starting with 16.2.0 and continuing through 16.3.5. Version 16.3.6 contains the security fix. Next.js 15 is not affected by this specific vulnerability, while applications using the Edge ImageResponse implementation are also outside the vulnerable scope.

Importantly, merely using ImageResponse does not automatically make an application exploitable. The vulnerable condition requires the Node.js implementation and attacker-controlled data being inserted into SVG content, attributes, or styles. For example, an application might accept a query string value and embed it into a dynamically generated social preview image. If that value reaches the vulnerable rendering pipeline without adequate control, an attacker could craft input designed to trigger the flaw.

This distinction matters for vulnerability prioritization. Developers should search their codebases for ImageResponse imports from next/og, including route handlers and opengraph-image implementations, then determine whether untrusted values influence the generated output. Some images are generated when requests arrive, meaning potentially vulnerable code paths may be directly internet-accessible.

The details for CVE-2026-94545 also highlight a supply-chain aspect of the vulnerability. The underlying weakness exists in Satori, where improperly escaped values can become active SVG content. Developers using Satori directly should update to version 0.33.5, which contains the corresponding fix. Next.js applications should update the framework itself rather than relying on an independently updated Satori package because Satori is bundled within Next.js.

Successful exploitation could provide an unauthenticated remote attacker with code execution in the context of the vulnerable Next.js server process. Depending on the application’s permissions and environment, this could expose application secrets, API credentials, environment variables, databases, cloud credentials, internal services, or other resources accessible from the compromised server.

Remote code execution could also provide an initial foothold for additional malicious activity, including payload deployment, credential theft, persistence, reconnaissance, and lateral movement. The exact post-exploitation impact therefore depends heavily on how the affected Next.js application is deployed and what permissions its server process possesses.

As of September 23, 2026, public reporting identified no confirmed attacks exploiting the vulnerability in the wild and no publicly available CVE-2026-94545 PoC. However, the vulnerability’s technical details are now public, meaning organizations should not interpret the absence of reported exploitation as an indication of low risk.

There are likewise no campaign-specific CVE-2026-94545 IOCs publicly documented in the cited research. Defenders should therefore focus on behavioral indicators, including unusual requests to dynamic image-generation endpoints, anomalous child processes spawned by Node.js applications, unexpected outbound communication from Next.js servers, suspicious file creation, and command execution originating from web application processes.

CVE-2026-94545 Mitigation

The primary CVE-2026-94545 mitigation is to upgrade affected Next.js applications to version 16.3.6. Vercel lists 16.3.6 as the patched version for the affected 16.x release line. Applications running Next.js 16.2.x must also move to 16.3.6 rather than waiting for a separate 16.2 security release.

Administrators should verify the actual production version rather than relying only on package manifests or dependency scanning. After updating, production applications and containers should be rebuilt and redeployed to ensure the patched framework is actually running.

Organizations should also audit application code for imports such as:

import { ImageResponse } from ‘next/og’

Particular attention should be given to route handlers, Open Graph image generators, and other components that create images dynamically from request data. Developers should identify any situation where URL parameters, API responses, form input, database content controlled by users, or other untrusted data can reach SVG content, attributes, or styles.

If an immediate upgrade is not possible, Vercel recommends ensuring that attacker-controlled values are not passed into SVG content, attributes, or styles rendered by the Node.js implementation of ImageResponse. This reduces exposure but should be considered a temporary workaround rather than a replacement for upgrading.

Organizations should also avoid assuming that switching runtimes is the preferred remediation. Although the Edge implementation is not vulnerable to this flaw, Vercel’s advisory specifically recommends removing attacker-controlled data from vulnerable rendering paths when upgrading cannot be performed immediately.

To Detect CVE-2026-94545 exploitation attempts, security teams should monitor application and reverse-proxy logs for unusual input sent to routes responsible for image generation. EDR and workload telemetry should also identify Node.js processes unexpectedly spawning shells or system utilities, creating executable files, accessing sensitive secrets, or establishing unusual outbound network connections.

Organizations that operated affected applications before patching should review historical telemetry for suspicious requests and post-exploitation behavior. Because no vendor-provided method currently determines whether a vulnerable route was previously exploited, combining application logs, EDR telemetry, cloud audit records, and network activity offers the strongest retrospective investigation approach.

Additionally, SOC Prime’s AI-Native Detection Intelligence Platform can help security teams operationalize emerging vulnerability intelligence into detection rules and hunting queries, enabling faster response to critical application security threats.

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If relevant detections are not yet available, check again as new detection content is continuously added.