Critical Next.js ImageResponse Flaw Allows Server Code Execution via Crafted SVG Input

Critical Vulnerability Discovered in Next.js

Vercel has disclosed a critical security vulnerability, tracked as CVE-2026-94545, in Next.js ImageResponse. This flaw could enable attackers to execute arbitrary code on a server if an application incorporates attacker-controlled values into the image generation process, such as text from a request URL.

Affected Versions and Fix

The vulnerability impacts Next.js versions 16.2.0 through 16.3.5 when ImageResponse operates on the Node.js runtime, which is the default for Next.js. Vercel, the developer of Next.js, addressed this issue on September 22 with the release of version 16.3.6. The Edge version of ImageResponse and Next.js 15 are not affected. The advisory rates the flaw as critical with a CVSS score of 9.5.

Exploitation Mechanism

ImageResponse utilizes Satori, a Vercel library, to convert image layouts into SVG code before generating the final PNG. Exploitation occurs when applications pass attacker-controlled values into SVG content, attributes, or styles during this image generation process. An example provided in the advisory shows a value from a request URL placed within an SVG title element.

Mitigation and Upgrade Steps

Developers should upgrade to Next.js 16.3.6 immediately using `npm install next@16.3.6`. For applications on the 16.2 line, upgrading to 16.3.6 is necessary as no patched release for 16.2 is available. As a temporary workaround, applications should prevent attacker-controlled values from being incorporated into SVG content, attributes, or styles rendered by the Node.js ImageResponse. The Next.js documentation marks the Edge runtime as deprecated, so switching to it is not a recommended long-term solution.

Current Status of Public Disclosure

As of September 23, no public reports of attacks or exploit code utilizing this flaw have been found. The vulnerability was not yet listed in the GitHub Advisory Database, and a CVE record for CVE-2026-94545 had not been published. `npm audit` also did not flag affected versions like Next.js 16.3.5 at that time, requiring direct version checks.