Critical Next.js Image Response Flaw Can Lead to Server Code Execution via Crafted SVG Input

Summary: Vercel fixed a critical Next.js flaw, CVE-2026-94545, on September 22 in version 16.3.6; it affects Next.js 16.2.0 through 16.3.5 when ImageResponse runs on the default Node.js runtime and carries a CVSS score of 9.5. The bug is in Satori, the Vercel library that converts image layout to SVG, which failed to escape certain values so crafted input could be read as SVG code and, per Vercel, reach vulnerabilities in unnamed dependent libraries and lead to code execution.
Why it matters: As of September 23, npm audit did not flag Next.js 16.3.5, the GitHub Advisory Database had no entry, and no CVE record was published - so your scanners may report clean on an affected app, and Vercel has not said whether hosted apps are protected or how to check whether a route was abused before the patch.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-94545
Related: ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026