A significant security flaw has been identified in Next.js, a popular web development framework, which could enable attackers to execute code on servers. This vulnerability is linked to the ImageResponse feature, responsible for generating Open Graph and social media preview images, according to Vercel, the company behind Next.js.
Understanding the Vulnerability
The flaw, cataloged as CVE-2026-94545, affects versions 16.2.0 to 16.3.5 of Next.js when ImageResponse operates on the Node.js runtime. Vercel has classified this issue as critical, assigning it a CVSS score of 9.5. Notably, the Edge version of ImageResponse and version 15 of Next.js are not impacted.
The vulnerability arises when applications incorporate attacker-controlled data into SVG content during image generation. The advisory warns about the risk of inserting such values into SVG elements, which could lead to unintended code execution.
Identifying and Mitigating the Risk
To identify if an application uses the vulnerable feature, developers should look for ImageResponse imports from next/og, particularly in route handlers or opengraph-image files. The vulnerability can be mitigated by updating to Next.js version 16.3.6, released on September 22, which addresses the flaw. For those unable to upgrade immediately, it is crucial to prevent attacker-controlled values from entering SVG content.
As of September 23, no known exploits or attacks leveraging this vulnerability have been reported. Additionally, there is no public exploit code available, and the issue has not yet been listed in the GitHub Advisory Database.
Future Implications and Recommendations
The underlying issue originates from Satori, a library used by Next.js to convert image layouts to SVG before generating PNGs. Satori’s advisory, which rates the issue as moderate with a CVSS score of 5.3, emphasizes the need for developers using Satori directly to update to version 0.33.5.
This vulnerability highlights the importance of regular updates and security checks in web applications to protect against potential exploits. Developers are advised to remain vigilant and ensure their systems are patched promptly to prevent any unauthorized code execution.
Vercel’s response to previous flaws suggests that hosted applications may receive automatic protections, though no such assurances have been provided for this specific flaw. As a precaution, developers should verify their Next.js version and review any potential vulnerabilities that might affect their applications.
