A critical Next.js vulnerability disclosed by Vercel affects applications that generate Open Graph or other dynamic images with ImageResponse and pass attacker-controlled data into the rendered image. The issue is tracked as CVE-2026-94545 and can, in affected configurations, lead to server-side code execution.

The vulnerability is especially important for teams that use dynamic social preview images, profile cards, article images, tenant-specific branding, or any route that builds images from URL parameters, request data, user profile fields, CMS content, or other untrusted input. Vercel fixed the issue on September 22, 2026, in Next.js 16.3.6.

Who is affected

According to the report, the affected range is Next.js 16.2.0 through 16.3.5 when ImageResponse runs on the Node.js runtime. That runtime is the default for Next.js. The Edge implementation of ImageResponse is not affected, and Next.js 15 is not listed as vulnerable to this specific critical issue.

Applications are at risk when they import ImageResponse from next/og and place attacker-controlled values into SVG content, SVG attributes, or styles during image generation. Common places to check include route handlers, opengraph-image files, and any code path that creates social preview images at request time.

This does not mean every Next.js application is exposed. A static site that does not use ImageResponse, or an application that never passes untrusted values into generated image output, has a different risk profile. However, because Open Graph image routes are often treated as low-risk presentation code, they may not receive the same security review as API handlers or authentication flows.

Why this matters

ImageResponse relies on Satori, a Vercel library that converts image layouts into SVG before producing the final image. The underlying problem is in how certain values could reach SVG output without sufficient escaping. If an attacker can cause specially crafted input to be interpreted as SVG markup rather than plain text, the image rendering pipeline can become a security boundary failure.

Vercel rates the Next.js impact as critical with a CVSS score of 9.5. The Satori advisory rates its own package impact lower because the risk depends on how the SVG output is consumed. In the Next.js context, Vercel says the crafted input may reach vulnerabilities in other dependent libraries and result in server code execution.

As of the report date, there were no public reports of active exploitation and no public exploit code identified by The Hacker News. That should not be read as a reason to delay. The affected versions have been available since the Next.js 16.2 release line, and dynamic image routes are externally reachable in many deployments.

Immediate actions for developers

The primary fix is to upgrade affected applications to Next.js 16.3.6. Teams on the 16.2 line should plan to move to 16.3.6 because the report notes there was no separate fixed 16.2 release listed at the time. Developers using Satori directly should update Satori to version 0.33.5.

A practical response checklist:

- Search the codebase for ImageResponse imports from next/og.
- Review opengraph-image files and route handlers that generate images dynamically.
- Identify any values coming from URLs, query strings, headers, cookies, user profiles, CMS fields, database records, tenant settings, or third-party integrations.
- Upgrade Next.js to 16.3.6 and rebuild affected services.
- If using Satori directly, update it to 0.33.5.
- Confirm the deployed artifact is running the patched package version, not only that the repository was updated.

Do not rely solely on automated dependency scanners for this issue. The Hacker News reported that npm audit did not flag Next.js 16.3.5 during its checks on September 23. Satori may also be bundled inside the Next.js package, so it may not appear as a separate dependency in a lockfile.

Temporary mitigation if patching is delayed

If an immediate upgrade is not possible, remove attacker-controlled values from the SVG content, attributes, and styles rendered by Node.js ImageResponse. This means more than basic input validation. Treat all values that can be influenced outside the application boundary as unsafe until they are either removed from image generation or handled by a patched renderer.

Examples of fields that deserve attention include article titles submitted by users, display names, organization names, slugs, search terms, campaign names, and theme or branding parameters. Even values that appear harmless in normal HTML may behave differently when they are inserted into an SVG-generation pipeline.

This mitigation should be treated as a short-term risk reduction step, not a replacement for upgrading. The advisory did not present switching to the Edge implementation as the recommended workaround, and the current Next.js documentation marks the Edge runtime as deprecated.

Operations and incident response guidance

After patching, security and platform teams should review access logs for unusual requests to dynamic image endpoints, especially requests with long, encoded, or markup-like parameter values. The public advisory does not provide a definitive indicator of compromise, so log review will be imperfect. Still, image-generation endpoints should be included in the same triage scope as API routes when a server-side execution issue is disclosed.

For production environments, prioritize internet-facing applications, multi-tenant systems, and services where generated images include user-controlled or customer-controlled data. If you host on a managed platform, do not assume platform-level protection unless your provider explicitly confirms it for this vulnerability. Patch verification should happen at the application dependency and deployed-runtime level.

The key takeaway is straightforward: if your Next.js 16 application uses ImageResponse, verify the runtime and upgrade to 16.3.6 as soon as possible. Dynamic image generation is application code, and in this case it should be handled with the same urgency as any externally reachable server-side rendering path.

Source: The Hacker News report