Next.js patches a critical RCE in next/og image generation, and npm audit did not flag it

Next.js has shipped a fix for a critical remote code execution flaw in its built-in image generation, and the more useful part of the story is how quietly it sat. The vulnerability, tracked as CVE-2026-94545 and rated 9.5 on the CVSS scale, lets attacker-controlled input reach the SVG rendering path inside next/og’s ImageResponse and, in the worst case, run code on the server. It only bites applications that pass untrusted data into that image pipeline, but for the apps that do, this is closer to a drop-everything upgrade than a routine dependency bump.

What the flaw actually is

ImageResponse is the API most Next.js teams reach for to generate Open Graph and social share images at request time. Under the hood on the Node.js runtime, it leans on Satori, Vercel’s library for turning markup into SVG, which is then rasterized into an image. According to the advisory and The Hacker News’ analysis, certain values reached Satori’s SVG output without being escaped, so a string meant to render as text could instead be interpreted as SVG markup. Once attacker input becomes live SVG content, attributes, or styles rather than inert data, it can reach downstream rendering code in a way that ends in remote code execution on the application server. The CVSS vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects that severity: network-reachable, low complexity, no privileges or user interaction required.

The exposure is scoped in two important ways. The advisory states the affected range is Next.js 16.2.0 up to but not including 16.3.6, and only the Node.js implementation of ImageResponse is vulnerable. Applications using the Edge implementation are not affected, and Next.js 15 sits outside the vulnerable range, with 15.5.26 shipped as a hardening release rather than a fix for an exploitable path.

Who is actually exposed

The dividing line is untrusted input. If an app only renders static or fully controlled values into its OG images, the advisory does not expect it to be affected. The apps at real risk are the ones that do the increasingly common thing: pull a page title, a username, a comment, or a query parameter into a dynamically generated image. That pattern is everywhere in blogs, dashboards, and social tools, which is what turns a scoped flaw into a broad one.

The detection story is the uncomfortable part. The Hacker News reported that npm audit did not flag Next.js 16.3.5, and the CVE was not yet listed in the GitHub Advisory Database at the time of its writing, so the usual automated signals that tell a team to patch were silent. Vulnerable releases have existed since roughly mid-March 2026, and while there are no public reports of exploitation or public exploit code, a critical bug that scanners do not surface is one teams have to go looking for.

The upgrade, and the interim

The fix is direct: upgrade to Next.js 16.3.6 or later and redeploy. Teams on the 15.x line can move to 15.5.26 for the hardening changes. Where an immediate upgrade is not possible, the advisory’s interim guidance is to stop passing attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse, and to escape any dynamic text properly first.

There is a deployment-hygiene footnote worth acting on. Netlify, reporting the same issue for its own platform, noted that the practical impact there was function crashes rather than code execution, which can still drive up cost, and it advised deleting vulnerable deploy previews and branch deployments until they cycle out. Any platform that keeps old preview builds live is worth a sweep, because a patched production deploy does not retire the vulnerable ones sitting behind preview URLs.

What it means

The lesson underneath the CVE is about trusted-input assumptions baked into framework primitives. ImageResponse reads as a rendering convenience, not an attack surface, so few teams think of an OG image as a place where a comment field can reach code execution. The bug is a reminder that any primitive which turns user data into a rendered artifact deserves the same input-hygiene scrutiny as a template or a query. The narrower takeaway is procedural: because standard scanning missed this one, patching Next.js this week should be a deliberate action rather than something a team waits for a tool to prompt.

Sources cited

1. Next.js security advisory GHSA-vcvr-r3jv-pc5j (GitHub Security Advisory, CVE-2026-94545) github.com
2. Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input (The Hacker News) thehackernews.com
3. Next.js ImageResponse security release: what to know (Netlify) www.netlify.com