Critical Next.js Vulnerability Allows Remote Code Execution
A critical vulnerability in Next.js ImageResponse functionality allows remote code execution. Tracked as CVE-2026-94545 with a CVSS score of 9.5, it affects the Node.js implementation in next/og. Vercel released Next.js 16.3.6 on September 22, 2026 to address the issue.
The flaw resides in the Node.js implementation of ImageResponse within next/og, a component widely used to generate Open Graph images and social previews dynamically. When applications pass untrusted data—such as URL parameters, API responses, or form submissions—into SVG content, attributes, or styles during server-side rendering, crafted values can traverse the SVG pipeline and trigger arbitrary code execution on the server.
Vercel's patch arrived September 22, 2026, in version 16.3.6. Given the CVSS score of 9.5 and the popularity of Next.js for production deployments, organizations using the framework for server-rendered graphics should prioritize upgrading and auditing any code paths that incorporate user-controlled data into image generation.
This vulnerability could affect a broad swath of web applications, since Next.js powers numerous production sites and ImageResponse is a common tool for generating social previews. Organizations that fail to patch promptly may face server compromise, data exfiltration, or lateral movement by attackers. Smaller teams with limited security resources could be especially vulnerable, as the exploitation path requires only that user input reach SVG rendering. The incident may also prompt wider scrutiny of how server-side image generation libraries handle untrusted data across the JavaScript ecosystem.