Critical Next.js ImageResponse Flaw Enables Remote Code Execution via Malicious SVG Input
ID: 02994aa1-20a1-5bfb-8448-4875c5c0eb20
STIX ID: report--02994aa1-20a1-5bfb-8448-4875c5c0eb20
Feed Name: Cyber Press
A critical remote code execution vulnerability (CVE-2026-94545 / GHSA-vcvr-r3jv-pc5j) exists in Next.js ImageResponse when using the Node.js runtime due to an upstream Satori SVG-escaping bug; Next.js versions 16.2.0–16.3.5 are affected and the issue is fixed in Next.js 16.3.6 (Satori 0.33.5). Applications that embed untrusted values into SVG elements, attributes, or styles for dynamic images (for example, Open Graph images) may allow unauthenticated attackers to trigger RCE on the image-generation server; teams should urgently patch, review next/og routes, and avoid rendering untrusted SVG content if immediate upgrade is not possible.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.