Critical Next.js ImageResponse RCE (CVE-2026-94545): A 9.5 That Hides in Your Image Generation
Vercel has disclosed a critical remote code execution flaw in the Node.js implementation of ImageResponse in Next.js, tracked as CVE-2026-94545. It carries a CVSS of 9.5, and it is network-reachable with no authentication and no user interaction. But whether it affects you comes down to a detail that a version check alone will not answer: whether untrusted data reaches the SVG your app generates. This is a case where "am I running an affected version" is only half the question. What the vulner
Vercel has disclosed a critical remote code execution flaw in the Node.js implementation of ImageResponse in Next.js, tracked as CVE-2026-94545. It carries a CVSS of 9.5, and it is network-reachable with no authentication and no user interaction. But whether it affects you comes down to a detail that a version check alone will not answer: whether untrusted data reaches the SVG your app generates. This is a case where "am I running an affected version" is only half the question.
What the vulnerability is
The flaw lives in next/og's ImageResponse on the Node.js runtime. Under specific conditions, improper escaping in the SVG output generated by Satori (the library Next.js uses to turn markup into images) can lead to remote code execution, by way of vulnerabilities in other upstream dependencies. The September 22 fix upgrades those dependencies, including Satori.
Two boundaries matter. First, only the Node.js ImageResponse implementation is affected. Applications using the Edge implementation are not. Second, exploitation requires attacker-controlled values to actually reach the generated SVG content, attributes, or styles. An application that never puts untrusted input into its generated images is not exposed, even on an affected version.
At the time of disclosure, there was no confirmed exploitation in the wild.
Who is affected
Next.js versions from 16.2.0 up to but not including 16.3.6 are affected. The fix is 16.3.6 (Active LTS). Next.js 15.x is not affected by the RCE; the 15.5.26 release contains related hardening only, not the vulnerable path.
So the version question is simple: are you on 16.2.0 through 16.3.5? But the version answer is not the whole story, which brings us to the part worth slowing down on.
Why a version check is not enough here
This is a 9.5 whose real blast radius depends on how you use the framework, not just which version you run. You are exposed only if all of these are true: you use the Node.js ImageResponse, you are on an affected version, and attacker-controlled data flows into the SVG you generate.
That third condition is the one teams miss, because the affected pattern is so ordinary. Dynamic image generation is exactly where external input tends to show up. Open Graph and social-preview images routinely embed URL parameters, usernames, page titles, and other values supplied from outside the application. That is precisely the kind of data that can become attacker-controlled, and it flows straight into the image pipeline by design.
So answering "does this affect me" is not a lookup, it is a short audit. Check your next/og usage and trace whether any externally supplied value lands in the SVG content, attributes, or styles you render. A frozen CVSS badge cannot tell you that. Your own code can.
What to do
Upgrade to Next.js 16.3.6. That is the clean fix and the right move for any affected application.
If you cannot upgrade immediately, Vercel's workaround is to remove untrusted SVG input from the Node.js ImageResponse path, so that no attacker-controlled value reaches generated SVG until you can patch. Migrating affected image generation to the Edge implementation also removes the exposure, since Edge is not affected.
If you run Next.js 15.x, you are not exposed to this RCE, though applying the 15.5.26 hardening release is still good practice.
Reading it on VulnTracker
A CVE like this is a good argument for tracking your stack rather than scanning headlines. On the VulnTracker CVE page, the header shows the 9.5 Critical score and the affected version range, so you can immediately see whether your Next.js version falls inside 16.2.0 to 16.3.5. The Affected Products section lets you Track Next.js and get alerted on future framework CVEs without watching advisories by hand. And the description makes the exposure conditions explicit, so you know to check your ImageResponse usage rather than assuming the version number settles it.
The two questions that decide your response are always the same: is the affected product in your stack, and do your conditions match the exposure requirements. For this one, that second question means auditing where untrusted input meets your image generation.
The takeaway
A critical score gets your attention, but it does not tell you whether you are actually reachable. CVE-2026-94545 is a clean example: same version, same framework, and one app is exposed while another is not, entirely because of whether untrusted data flows into a generated image. Knowing your stack, and how you use it, is what turns a scary number into a decision you can act on.
Track CVE-2026-94545 and your Next.js version at vulntracker.io
References: Next.js security advisory (GHSA-vcvr-r3jv-pc5j) · Next.js security update