CVE-2026-94545: Critical Next.js ImageResponse Flaw Enables Remote Code Execution

CVE-2026-94545 is a critical (CVSS 9.5) remote code execution vulnerability in Next.js's Node.js ImageResponse (next/og) where unescaped attacker-controlled values can become active SVG content, potentially allowing unauthenticated RCE on servers; affected Next.js versions 16.2.0 through 16.3.5 should be upgraded to 16.3.6 (and Satori to 0.33.5) immediately, accompanied by code audits to ensure untrusted data is not injected into SVGs and by monitoring for suspicious image-generation requests and post-compromise behavior.