Project
Open-source Node.js image processing library built on libvips that resizes and converts JPEG, PNG, WebP, AVIF and SVG; Next.js uses it for image optimization.
Next.js released versions 16.4.1 and 15.5.28 on October 14 to fix two unauthenticated code-execution flaws that Vercel rated CVSS 9.5. As of October 15 the caching flaw had no CVE and no workaround, so npm audit may stay quiet and only the upgrade closes it.
Reality
Satori, the JSX-to-SVG step behind Next.js next/og, put external input into SVG unescaped, per a dev.to explainer of CVE-2026-94545. The explainer says code execution would need the injected SVG to corrupt memory in a native parser, while SSRF needs only the injection.
Reality
The affected releases stretch back to Next.js 13.4, and for Windows self-hosters the only remedy Vercel offers is the version bump. The AVIF bug shipped in the same release at least has a config gate.
Reality
Generated images arrive with three metadata layers plus a pixel signal that no metadata tool touches, and whether the signed manifest survives depends on whether anything in your pipeline decodes and writes the file again.
Reality
A wallpaper site's post-mortem on serving 70,000-plus 4K masters through Next.js 15 shows the optimizer failing on Referer checks and edge CPU ceilings, not on throughput.
Reality