Critical Next.js ImageResponse flaw: patch to 16.3.6

Vercel has patched a critical flaw in Next.js that affects ImageResponse, the helper used to generate Open Graph and other social preview images. The issue, tracked as CVE-2026-94545, can lead to code execution on the server when an application passes attacker-controlled values into the generated image. The fix landed on 22 September in Next.js 16.3.6.

What happened

According to the original report, versions 16.2.0 through 16.3.5 are affected when ImageResponse runs on the Node.js runtime, which is the default. Vercel rates the issue critical with a CVSS score of 9.5. Next.js 15 is not affected, and the Edge variant of ImageResponse is not affected either — though the Edge runtime is marked deprecated in the documentation.

The underlying bug is in Satori, the Vercel library that turns the image layout into SVG before the PNG is produced. Satori's own advisory, published the same day, says certain values reached the SVG output without proper escaping, so a crafted value could be interpreted as SVG code rather than plain text. Satori rates the same CVE as moderate (5.3), because impact depends on how the SVG is consumed; in Next.js, Vercel says such values can reach other bundled libraries and result in code execution. Those libraries have not been named.

Two practical details from the report are worth noting. First, tooling was lagging: as of 23 September, npm audit did not flag the affected 16.3.5, the advisory was not yet in the GitHub Advisory Database, and no CVE record had been published. Second, Satori is bundled inside the Next.js package, so it will not appear in your lockfile as a separate dependency. Version checks have to be done against Next.js itself. No public exploit code or reports of attacks were known at the time of writing.

Why it matters

Open Graph image routes look harmless and are often written once and forgotten. Many SMB sites and SaaS dashboards generate preview cards from query parameters — a title, a name, a plan — which is precisely the pattern the advisory describes as risky. These routes are usually public, unauthenticated and reachable by anyone who can craft a URL.

Because automated scanners had not yet caught up, a clean dependency audit report was not evidence of safety here. Affected versions have been available since Next.js 16.2 shipped on 18 March, and the advisory offers no way to tell whether a route was abused before the patch.

What to do

1. Check the installed Next.js version directly. If it is between 16.2.0 and 16.3.5, upgrade to 16.3.6 — the report notes the npm registry listed no fixed release on the 16.2 line, so 16.2 apps must move to 16.3.6. On the 15.5 line, 15.5.26 adds hardening for next/og.
2. Inventory usage: search for ImageResponse imported from next/og, including route handlers and opengraph-image files. Note which of them read values from the request.
3. If the upgrade cannot happen immediately, apply the advisory's workaround: keep attacker-controlled values out of the SVG content, attributes and styles rendered by the Node.js path.
4. If you use Satori directly, update it to 0.33.5. Keep access logs for the affected routes while you assess exposure.