A critical security vulnerability identified as CVE-2026-94545 has been discovered in Next.js, affecting the Node.js ImageResponse implementation within the next/og package. This flaw could potentially allow remote code execution (RCE) through the exploitation of malicious SVG files during image rendering.
Next.js Versions Affected
This vulnerability impacts Next.js versions 16.2.0 up to but not including version 16.3.6. Developers are strongly advised to upgrade to version 16.3.6, which includes crucial security patches addressing this issue.
The vulnerability lies in the ImageResponse component used for generating dynamic Open Graph images and other server-generated graphics. An upstream security flaw can be exploited when user-controlled data is embedded in SVG elements, attributes, or styles.
Exploitation Details
An attacker might exploit this flaw by submitting specially crafted SVG-related input to a vulnerable application. This is possible when the application processes untrusted data from sources such as URL parameters or form fields and incorporates it directly into an SVG element.
For instance, an application may accept a value from an incoming request and render it within an SVG code element through the ImageResponse component, leading to potential RCE on the server processing the image request.
Impact and Mitigation
The vulnerability is classified as Critical under the CVSS v4 metrics, primarily because it can be executed remotely without any authentication or user interaction. The potential impact is significant, potentially compromising the confidentiality, integrity, and availability of affected systems.
Exploitation could expose sensitive server data, alter hosted content, interrupt services, or provide attackers a foothold for further intrusions. The actual effect depends on the specific Next.js deployment, its permissions, and the access scope of the image-generation process.
Not every Next.js deployment is vulnerable. Applications using the Edge implementation of ImageResponse are not affected. Additionally, applications that do not incorporate attacker-controlled values into SVG content remain secure.
Organizations should urgently assess image-generation endpoints using next/og, particularly those handling Open Graph images with query parameters. Updating to version 16.3.6 is crucial. If immediate updates are not feasible, developers should avoid embedding user-supplied input into SVG content, attributes, and styles processed by Node.js ImageResponse.
While input validation is necessary, it should not be considered a comprehensive solution due to complex SVG parsing and rendering behaviors that may introduce unexpected attack vectors.
The vulnerability was reported by security researchers RaghavMaheshwari124 and rafabd1. Given the ease with which internet-facing endpoints can be discovered, Next.js users are urged to prioritize patching this critical security gap.
