Next.js ships an out-of-band patch for a critical RCE in its Open Graph image generator
An out-of-band Next.js 16.3.6 fixes a critical RCE (CVE-2026-94545) in the Node.js next/og ImageResponse, reachable when attacker-controlled text flows into Satori's SVG output. Apps on 16.2.0 through 16.3.5 rendering user data into images should patch now.
Next.js shipped an out-of-band security release on September 22, 2026, to close a critical remote code execution hole in its Open Graph image generator. The fix lands in 16.3.6 on the Active LTS line and 15.5.26 on Maintenance LTS, and it is the kind of advisory that warrants patching the same day you read it: the vulnerable code path runs on the server, and a successful attack ends in arbitrary code execution rather than a leaked header or a broken render.
What the flaw actually is
The vulnerability, tracked as CVE-2026-94545 and GHSA-vcvr-r3jv-pc5j, lives in
the Node.js implementation of ImageResponse in next/og, the built-in helper
most teams use to render dynamic social-share images. That helper leans on
Satori, the open-source library that turns HTML and CSS into SVG. Satori did not
properly escape values it wrote into SVG output, and when those values were
attacker-controlled, the malformed SVG could reach other upstream dependencies in
a way that led to remote code execution. Next.js carries its own advisory for the
exposure and points at the upstream Satori advisory, GHSA-wx4j-mvgx-mqwp, as the
root cause. The 16.3.6 release does not rewrite next/og: it upgrades the
upstream dependencies, Satori among them, that made the escape possible.
Who is affected, and who is not
The affected range is narrow in version terms and wide in deployment terms:
Next.js 16.2.0 up to but not including 16.3.6. Two conditions narrow it further.
First, only the Node.js runtime implementation of ImageResponse is vulnerable;
apps that generate images through the Edge implementation are not affected.
Second, the flaw only triggers when attacker-controlled values flow into SVG
content, attributes, or styles during that Node image generation. An app that
renders images purely from static or trusted server-side data is not exposed,
even on an affected version. The 15.x line is a separate note: 15.5.26 ships
related hardening, but Next.js 15.x is not affected by the RCE itself.
The trap is that the second condition is easy to misjudge. Rendering a username,
a page title, a search query, or any other user-supplied string into a dynamic OG
image is an extremely common pattern, and it is exactly the pattern that puts an
app in range. Teams should assume they are affected if they take user input into
next/og on Node, and verify otherwise, rather than the reverse.
What developers should do
Upgrade. Run npm install next@16.3.6 for the 16.3 line, or next@15.5.26 for
15.5, then redeploy. There is no configuration toggle that substitutes for the
dependency upgrade, because the fix lives in the upstream packages Satori pulls
in. Teams that genuinely cannot upgrade at once can reduce exposure by ensuring
no user-controlled data reaches next/og image generation on the Node runtime,
but that is mitigation, not a fix, and it is easy to get wrong across a large
codebase.
Why an image helper became a remote-code-execution risk
The instructive part is how ordinary the vulnerable surface is. next/og is
convenience infrastructure: it exists so teams do not hand-build social preview
images, and it gets enabled and used without much thought because it feels like a
rendering utility rather than a place untrusted input gets parsed. That is
precisely why this class of bug matters. A dynamic image endpoint takes user
input, runs it through a chain of HTML-to-SVG-to-raster dependencies, and does
all of it on the server. Each hop in that chain is code most application
developers never read, and an escaping mistake several layers down surfaces as an
RCE in an app that only ever meant to draw a card with a title on it. The
advisory credits researchers working through Vercel’s open-source bug bounty,
the mechanism that caught this before it became an incident.
What to watch
The immediate signal is patch adoption. Out-of-band releases for critical RCEs
tend to be followed by opportunistic scanning for unpatched hosts, and dynamic OG
routes are trivial to fingerprint. Beyond the patch, the broader lesson is worth
holding onto: as frameworks absorb more rendering and image work into first-party
helpers, they also absorb the upstream supply chain those helpers depend on, and
a critical bug in a transitive dependency becomes the framework’s advisory to
ship. Teams that treat next/og as inert plumbing are the ones most likely to
miss this one. Stackmaven will revisit patch uptake and any follow-on advisories
around October 22.