By Vercel patched a critical remote code execution vulnerability in next/og on September 22. The flaw, tracked as CVE-2026-94545 (CVSS v4: 9.5), affects the ImageResponse API that Next.js developers use to generate social sharing preview cards. If you’re on Next.js 16.2.0 through 16.3.5, on the Node.js runtime, and your OG image routes accept any user-supplied input, your application server is exposed. One command fixes it: npm install next@16.3.6.
Who Is Affected
The vulnerable range is Next.js 16.2.0 through 16.3.5, using ImageResponse from next/og, on the Node.js runtime. Two important carve-outs: the Edge runtime version of ImageResponse is not affected, and neither is Next.js 15 (the fix is also backported to 15.5.26).
The flaw is only exploitable if attacker-controlled input reaches the SVG content, attributes, or styles rendered inside ImageResponse. The most common way this happens is the most common pattern: reading a page title, author name, or description from URL query parameters and rendering it into the OG image. That straightforward, standard implementation is the attack path.
The Fix
Upgrade. That’s it.
# For the 16.x line
npm install next@16.3.6
# For the 15.x line
npm install next@15.5.26Satori is bundled inside Next.js, so upgrading the framework upgrades the underlying library automatically. No application code changes needed for most projects. Dozens of open-source maintainers — including teams behind Dify and Cloudflare Vinext — have already filed upgrade PRs. This is not a “watch and wait” situation.
If you genuinely cannot upgrade right now, switch affected OG image routes to the Edge runtime as a temporary measure — it uses a different rendering path and is not affected by this CVE. Input validation alone will not save you here; the escaping failure is in how Satori writes SVG, not in what gets passed to it.
Where the Bug Actually Lives
CVE-2026-94545 is attributed to Next.js, but the root cause is in Satori (GHSA-wx4j-mvgx-mqwp), Vercel’s library for converting JSX into SVG. Satori before version 0.33.5 failed to escape certain values before inserting them into generated SVG output. A value placed into SVG content or an attribute could break out of its context and be interpreted as live SVG markup by the downstream renderer.
From there, the injected markup executes on the Node.js application server. The exploit path requires no authentication — OG image routes are public by design, since social crawlers need to reach them without logging in. Attack complexity is low. CVSS 9.5 is the math that results.
No confirmed exploits in the wild were reported as of September 23, but a proof-of-concept validation lab has appeared on GitHub. The window to patch before active exploitation typically closes fast once PoC code circulates.
OG Routes Are an Overlooked Attack Surface
This flaw is a useful reminder that next/og routes run on your server, not in the browser. They process user-controlled input and render it through a non-trivial image generation pipeline. Most developers do not think about their social sharing image endpoint as a server-side code execution risk — that mental model mismatch is exactly what makes it a useful target.
Satori is the de facto standard for this use case. That makes a critical flaw in it a hit across an enormous share of the Next.js ecosystem at once. This is the same dynamics that made Log4Shell and XZ Utils so disruptive: widely trusted upstream libraries are high-leverage targets.
Check your version now:
cat package.json | grep '"next"'If the output shows anything from 16.2.0 to 16.3.5, you have work to do. The fix is one command and takes under a minute. Run it.
