"pass attacker-controlled values into SVG content, attributes, or styles during image generation," Vercel warned in its advisory.
How ImageResponse and Satori combine to create a risky surface
Next.js's ImageResponse feature converts layout into SVG and then into a PNG to produce Open Graph and social preview images. Vercel said ImageResponse uses Satori, a Vercel library, to perform the SVG conversion. Satori's own advisory describes the root bug: certain values reached its SVG output without being properly escaped, so a specially crafted value could be interpreted as SVG code rather than plain text.
Vercel explained that when those SVG outputs are used inside Next.js, the malformed SVG can pass into other libraries Next.js depends on and, in some cases, lead to remote code execution. Vercel has not named those downstream libraries.
Which Next.js versions, runtimes, and usages are affected
The flaw, tracked as CVE-2026-94545, affects Next.js 16.2.0 through 16.3.5 when ImageResponse runs on the Node.js runtime — the default Next.js runtime. Vercel rated the issue critical with a CVSS score of 9.5. The Edge version of ImageResponse is not affected, and Next.js 15 is not affected.
Vulnerable apps are those that place attacker-controlled values — for example, text taken from a request URL — into SVG content, attributes, or styles while generating images on the Node.js ImageResponse path. Vercel's advisory includes an example that takes a value from the request URL and places it inside an SVG title element; the advisory does not say whether inserting text into ordinary HTML-like elements (for example, a heading inside a div) would also trigger the problem.
To locate uses of the feature, developers should look for ImageResponse imported from next/og, commonly found in route handlers and opengraph-image files. Route handlers generate the image at request time; an opengraph-image file may generate it either at build time or on request.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadPatch, workarounds, and the state of public reporting as of September 23
Vercel issued a fix on September 22 in Next.js version 16.3.6. The published installation command is npm install next@16.3.6. As of September 23, the npm registry listed no fixed release for the 16.2 line, meaning applications still on 16.2 must move to 16.3.6 to receive the fix. Next.js 15.5.26 also adds extra security hardening for next/og on the 15.5 line.
Vercel's advisory recommends a workaround for those unable to upgrade immediately: keep attacker-controlled values out of the SVG content, attributes, and styles that the Node.js ImageResponse renders. The advisory does not recommend switching to the unaffected Edge version, and Next.js documentation marks the Edge runtime as deprecated.
On public reporting, The Hacker News found no public reports of attacks exploiting the flaw and no public exploit code as of September 23. Additional signals were mixed: npm audit did not flag an affected release (16.3.5) in checks performed on September 23, the advisory was not yet listed in the GitHub Advisory Database, and no CVE record for CVE-2026-94545 had been published in public CVE records as of that date.
What this means for developers, Vercel-hosted apps, and security teams
- Developers and application owners: If your app uses ImageResponse on Node.js and passes user-controlled strings into SVG content, attributes, or styles, the only fully patched Next.js release listed by Vercel is 16.3.6; upgrading is the prescribed remediation. Satori users who include the library directly should update Satori to version 0.33.5, which contains the fix Satori published the same day.
- Vercel-hosted applications: Vercel's advisory and announcement do not say whether apps hosted on Vercel are protected. For context, the company previously said hosted apps were protected and needed no upgrade for two critical Next.js flaws fixed in August, but Vercel made no similar statement for this September 22 fix.
- Security and incident-response teams: Vercel's advisory and announcement provide no way to check whether an affected route was abused before the patch. The affected Next.js releases have been available since Next.js 16.2 was released on March 18, so teams that cannot immediately upgrade must treat historical exposure as an open question.
The technical record is straightforward: the bug resides in Satori's SVG output escaping, Next.js bundles Satori (so a package lockfile will not list Satori as a separate dependency), and Vercel has published a Next.js patch and a separate Satori patch. What remains unresolved in public materials is whether hosted deployments were protected and whether compromised routes can be detected retrospectively — gaps Vercel's advisory did not fill as of September 23.
