{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-25AF3C29",
  "slug": "ghsa-vcvr-r3jv-pc5j-nextjs-og-imageresponse-rce",
  "title": "CVE-2026-94545 Next.js next/og ImageResponse RCE on Node.js (GHSA-vcvr-r3jv-pc5j)",
  "aliases": [
    "CVE-2026-94545",
    "GHSA-vcvr-r3jv-pc5j",
    "GHSA-wx4j-mvgx-mqwp",
    "BREAKING: CVE-2026-94545 Next.js next/og ImageResponse RCE (GHSA-vcvr-r3jv-pc5j)",
    "Next.js September 22 2026 security update"
  ],
  "summary": "Same-day Critical remote code execution in the Node.js ImageResponse implementation from next/og (CVE-2026-94545 / GHSA-vcvr-r3jv-pc5j). Improper SVG escaping in upstream Satori can lead to RCE when attacker-controlled values are passed into SVG content, attributes, or styles. Patched Next.js is 16.3.6. Next.js 15.x is not affected by the RCE; 15.5.26 is hardening only. Edge ImageResponse is not affected.",
  "status": "published",
  "severity": "critical",
  "confidence": "high",
  "uncertainty": "CVE-2026-94545 is listed on the GitHub advisory; NVD and cve.org may still lag. Confirm your running next version and whether Node ImageResponse handlers pass request input into SVG. Do not invent in-the-wild exploitation or KEV status.",
  "firstObservedAt": "2026-09-22T17:03:51.000Z",
  "lastObservedAt": "2026-09-22T18:22:46.517Z",
  "publishedAt": "2026-09-22T18:25:57.288Z",
  "reviewedAt": "2026-09-22T18:25:51.776Z",
  "expiresAt": "2026-09-22T18:22:46.517Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "nextjs-blog",
      "label": "Next.js security update September 22 2026",
      "url": "https://nextjs.org/blog/nextjs-security-update-september-22-2026",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-09-22T17:00:00.000Z"
    },
    {
      "id": "ghsa-next",
      "label": "GHSA-vcvr-r3jv-pc5j / CVE-2026-94545 Next.js next/og ImageResponse RCE",
      "url": "https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-09-22T17:03:51.000Z"
    },
    {
      "id": "ghsa-satori",
      "label": "GHSA-wx4j-mvgx-mqwp Satori improper SVG escaping",
      "url": "https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-09-22T17:00:00.000Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL Guard operator write-up",
      "url": "https://hol.org/blog/ghsa-vcvr-r3jv-pc5j-nextjs-og-imageresponse-rce",
      "sourceType": "other_primary",
      "observedAt": "2026-09-22T17:43:05.068Z"
    }
  ],
  "artifacts": [
    {
      "id": "pkg-next",
      "artifactClass": "package",
      "ecosystem": "npm",
      "name": "next",
      "version": ">=16.2.0 <16.3.6 (patched 16.3.6)",
      "defanged": false
    },
    {
      "id": "pkg-satori",
      "artifactClass": "package",
      "ecosystem": "npm",
      "name": "satori",
      "version": ">=0.0.27 <0.33.5 (patched 0.33.5)",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "disclosure",
      "occurredAt": "2026-09-22T17:03:51.000Z",
      "eventType": "disclosure",
      "summary": "GHSA-vcvr-r3jv-pc5j published: Critical RCE in Next.js Node.js ImageResponse from next/og; upstream Satori GHSA-wx4j-mvgx-mqwp.",
      "sourceIds": [
        "ghsa-next",
        "ghsa-satori",
        "nextjs-blog"
      ]
    },
    {
      "id": "vendor-action",
      "occurredAt": "2026-09-22T17:00:00.000Z",
      "eventType": "vendor_action",
      "summary": "Next.js out-of-band releases 16.3.6 (RCE fix) and 15.5.26 (hardening only for 15.x).",
      "sourceIds": [
        "nextjs-blog"
      ]
    },
    {
      "id": "hol-publish",
      "occurredAt": "2026-09-22T17:43:05.068Z",
      "eventType": "other",
      "summary": "HOL Guard published BREAKING operator blog coverage for GHSA-vcvr-r3jv-pc5j.",
      "sourceIds": [
        "hol-blog"
      ]
    },
    {
      "id": "cve-alias",
      "occurredAt": "2026-09-22T18:22:46.517Z",
      "eventType": "correction",
      "summary": "GitHub advisory now lists CVE-2026-94545 for GHSA-vcvr-r3jv-pc5j; HOL blog and campaign patched in place (slug and publishedAt unchanged).",
      "sourceIds": [
        "ghsa-next",
        "hol-blog"
      ]
    }
  ],
  "coverage": [
    {
      "assertionId": "guard-evidence-pack",
      "relationship": "not_covered",
      "limitation": "HOL Guard CVE evidence pack for CVE-2026-94545 / GHSA-vcvr-r3jv-pc5j 404s at correction time; campaign links the operator blog and vendor advisories."
    }
  ],
  "policies": [],
  "limitations": [
    "Edge ImageResponse is not affected.",
    "Next.js 15.x is not affected by the RCE; 15.5.26 is hardening only.",
    "Apps that never pass attacker-controlled values into SVG content, attributes, or styles during Node ImageResponse generation are not affected.",
    "Already on next@16.3.6+ is out of scope for this issue.",
    "This is not the August AVIF/libheif Image Optimization RCE (GHSA-2xp9) and not CVE-2026-75604 Windows path RCE.",
    "NVD and cve.org may lag behind the GitHub CVE ID assignment.",
    "HOL blog is operator guidance, not a substitute for the vendor advisory."
  ],
  "correctionHref": "/guard/security/campaigns/ghsa-vcvr-r3jv-pc5j-nextjs-og-imageresponse-rce/corrections"
}