next/og can run code when ImageResponse gets attacker-controlled SVG values
On September 22, 2026, Next.js published GHSA-vcvr-r3jv-pc5j. The Node.js ImageResponse in next/og can lead to remote code execution when attacker-controlled values are placed in SVG content, attributes, or styles. next 16.2.0 before 16.3.6 is affected. The patched release is 16.3.6.
What was reported
The Next.js advisory published September 22, 2026 says the Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability that can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation. The advisory says applications using the Edge ImageResponse implementation are not affected, and neither are applications that do not pass attacker-controlled values into those SVG positions. The affected range is next 16.2.0 before 16.3.6. The patched release is 16.3.6.
CVE-2026-94545, published September 30, 2026, describes the upstream issue in Satori: versions 0.0.27 before 0.33.5 do not properly escape certain values before including them in generated SVG, so crafted values can be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. The record says version 0.33.5 contains the patch, that no complete workaround exists besides upgrading, and that the same Next.js range, 16.2.0 before 16.3.6, is affected.
How to prevent it
Upgrade next to 16.3.6 or later if you are on 16.2.0 before 16.3.6 and you generate images with the Node.js ImageResponse from next/og. Until you upgrade, do not pass attacker-controlled values into SVG content, attributes, or styles. The Next.js advisory says the Edge ImageResponse implementation is not affected, and neither are apps that do not pass attacker-controlled values into those SVG positions. CVE-2026-94545 says the upstream Satori fix is 0.33.5.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.