On this page
Vercel published an out-of-band Next.js security update on 2026-09-22. The Critical path is remote code execution in the Node.js ImageResponse implementation from next/og (CVE-2026-94545 / GHSA-vcvr-r3jv-pc5j, CVSS 9.5). It comes from improper SVG escaping in upstream Satori (GHSA-wx4j-mvgx-mqwp), which Next.js pulls in for OG image generation. Patched Next.js is 16.3.6. Next.js 15.x is not affected by the RCE; 15.5.26 is hardening only. GitHub lists CVE-2026-94545 on GHSA-vcvr-r3jv-pc5j. CVE.org was updated on 2026-09-30 and now presents the shared CVE under the upstream Satori context at Moderate 5.3, while the Next.js product advisory remains Critical 9.5 for the affected Node.js ImageResponse path. This is the operator write-up from the Next.js blog and the GitHub advisories.
Who is not in scope
Skip the pager if any of these hold:
- You already run
[email protected]or newer on the 16.x train. - The app is on Next.js 15.x for the RCE itself. The September 22 cut still ships
15.5.26as related hardening, but the vendor states 15.x is not affected by this remote code execution issue. - You use only the Edge
ImageResponseimplementation. Edge is not affected. - Your Node.js
ImageResponsehandlers never pass attacker-controlled values into SVG content, attributes, or styles during image generation.
If a public OG route takes a query param, header, or other request field and drops it into JSX/SVG that ImageResponse renders on Node, treat yourself as in scope until you patch.
What broke
Next.js Node.js ImageResponse RCE (CVE-2026-94545 / GHSA-vcvr-r3jv-pc5j). Affected next versions are >= 16.2.0 and < 16.3.6. The Node.js path from next/og is vulnerable when attacker-controlled values reach SVG content, attributes, or styles. The advisory example wires a searchParams value into an SVG <title> inside ImageResponse. Under those conditions, improper escaping in Satori-generated SVG can lead to remote code execution through other upstream dependencies. The Next.js fix upgrades those dependencies. Severity on the GHSA is Critical 9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). Credit: KarimPwnz.
Upstream Satori improper SVG escaping (GHSA-wx4j-mvgx-mqwp). Satori versions >= 0.0.27 and < 0.33.5 do not properly escape certain values before including them in generated SVG. Crafted values can be interpreted as SVG markup. Impact depends on how the SVG is consumed. Patched Satori is 0.33.5. Severity is Moderate 5.3. For Next.js apps, do not chase a standalone Satori bump as the product fix; install the patched Next.js release that vendors the upgrade.
Confirmed on the npm registry today: [email protected] and [email protected] both resolve. The Next.js September 22, 2026 security update blog is live (no longer Upcoming). No matching Vercel changelog entry was present at publish time; use the Next.js blog and the two GHSAs as primary records.
What this is not
This is not the August 2026 Image Optimization AVIF / libheif RCE (GHSA-2xp9-vwfh-vxw4). It is not CVE-2026-75604, the Windows path-traversal RCE that needed both routers without Cache Components. It is not automatic RCE on every next/og use: Edge ImageResponse is out, and Node handlers that never feed attacker-controlled values into SVG content, attributes, or styles are out. CVE ID CVE-2026-94545 is on the GitHub advisories and CVE.org. CVE.org currently describes the upstream Satori issue at Moderate 5.3 and lists both the Satori and Next.js affected ranges. The Next.js GHSA separately rates the downstream Next.js RCE context Critical 9.5. Keep those source contexts distinct. We are not claiming CISA KEV listing or in-the-wild exploitation; that status is unknown from the primary sources.
How to check
Confirm the next package the running process actually loaded:
npx next --version
# or
npm ls nextOn the 16.x train, anything >= 16.2.0 and below 16.3.6 is in the RCE window. Then inventory Node.js OG routes that take request input into SVG:
# look for Node ImageResponse from next/og (not Edge-only handlers)
rg -n "from ['\"]next/og['\"]|ImageResponse" app pages src --glob '*.{js,jsx,ts,tsx}'
# then check whether searchParams, headers, cookies, or body fields land in SVG props/children/stylesIf that path exists and you are still below 16.3.6, patch before you argue about whether the values are "really" attacker-controlled.
How to fix
npm install [email protected] # 16.x Active LTS (RCE fix)
npm install [email protected] # 15.x Maintenance LTS (hardening only; 15.x not affected by the RCE)If you cannot upgrade immediately, the GHSA workaround is: do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation from next/og. That is a temporary constraint, not a substitute for 16.3.6 on affected 16.x apps.
HOL Guard now has a CVE evidence page for CVE-2026-94545. It follows the upstream Satori context at Moderate 5.3. For the Next.js product impact, use the Next.js September 22, 2026 security update and GHSA-vcvr-r3jv-pc5j, which rate the affected Node.js ImageResponse path Critical 9.5.
References
- Next.js security update: September 22, 2026
- GHSA-vcvr-r3jv-pc5j (Next.js next/og ImageResponse RCE)
- GHSA-wx4j-mvgx-mqwp (Satori improper SVG escaping)
- CVE-2026-94545 record
- HOL Guard CVE-2026-94545 evidence page
- Prior related HOL write-up: CVE-2026-75604 / August Image Optimization path (different bugs)
