CVE-2026-94545 – From JSX to SVG Injection
ID: 4f020195-dd23-5b13-ae9b-4bbba21f19b4
STIX ID: report--4f020195-dd23-5b13-ae9b-4bbba21f19b4
Feed Name: Checkmarx Zero
Threat Score
TL;DR — A critical Remote Code Execution vulnerability (CVE-2026-94545) in Next.js ImageResponse was caused by insufficient SVG escaping in the Satori dependency; it affects Next.js 16.2.0 through 16.3.5 and has been fixed in 16.3.6. Users running affected versions should upgrade to 16.3.6 (Next.js 15 and Edge ImageResponse implementations are not affected), and Checkmarx SCA already flags this issue in scans.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.