Security1 publisher2 min readPublished
Crafted Open Graph text can reach code execution in Next.js 16.2 through 16.3.5
CVE-2026-94545 lets attacker-supplied text in an Open Graph image reach Next.js dependencies. Vercel shipped the fix on September 22 in 16.3.6; a day later, npm audit still passed affected builds.
The Watch · Security desk
What happened
- Vercel fixed CVE-2026-94545 on September 22 in Next.js 16.3.6; it affects 16.2.0 through 16.3.5 when ImageResponse renders on the Node.js runtime, which Next.js uses by default.
- The bug sits in Satori, the Vercel library that turns an image layout into SVG, which let certain values through unescaped so a crafted string is read as SVG code instead of plain text.
- Vercel said those values can then reach vulnerabilities in other libraries Next.js depends on and lead to code execution, without naming the libraries.
- Vercel's advisory rates the flaw critical at CVSS 9.5, while Satori's advisory, published the same day, rates the same CVE moderate at 5.3.
- As of September 23, The Hacker News had turned up no public reports of attacks using the flaw and no public exploit code.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Scanner-driven triage will not queue this one, so each team has to read its own Next.js version before it can say whether it is exposed.
- exposure The upgrade closes the path. It leaves the incident question open: no published method exists for telling whether an affected route was hit before September 22.
- decision Edge ImageResponse is unaffected but the Edge runtime is deprecated in the Next.js docs, so the practical options are 16.3.6 or removing attacker input from the image.
- contradiction In August Vercel told customers its own hosting protected them from two critical Next.js flaws; teams on that hosting are now on the same upgrade clock as self-hosted ones.
The two ratings measure different things. Satori's advisory scores the escaping failure in its own output at 5.3 and says the impact depends on how that SVG is used [5]. Vercel scores the chain at 9.5, because the code consuming that SVG inside a Next.js app is Next.js, and Vercel says the injected values can reach vulnerabilities in libraries it depends on [4][7]. The spread between the two numbers is 4.2 points on one CVE [27]. Apps on the default Node runtime fall under Vercel's scenario [2].
What is exploitable depends on where the attacker's string lands. Vercel's condition is apps that "pass attacker-controlled values into SVG content, attributes, or styles during image generation" [8]. The worked example takes a value from the request URL and places it inside an SVG title element, so one request to a route that renders URL text into an image is the whole setup [9]. On text in ordinary elements, such as a heading inside a div, the advisory is silent [9]. Until that is settled, any request-derived string reaching next/og has to be treated as in scope, in route handlers and in opengraph-image files [24].
In checks by The Hacker News on September 23, npm audit did not flag Next.js 16.3.5, the advisory had not appeared in the GitHub Advisory Database, and no CVE record for CVE-2026-94545 had been published [14][15]. Satori ships bundled inside the Next.js package, so it does not show up in a lockfile as a Next.js dependency [18]; the Next.js version is what a team has to read [29].
Affected builds have been installable since 16.2 shipped on March 18, which is 188 days before the September 22 patch [22][3][26].
16.3.6 is the only patched release. Apps pinned to 16.2 take a minor version bump to get the fix, because as of September 23 the npm registry listed no fixed build on the 16.2 line [16]. Next.js 15 is not affected, and 15.5.26 adds extra hardening for next/og on that line [10][17]. Teams calling Satori directly need 0.33.5 [23]. Where an upgrade has to wait, Vercel's workaround is to keep attacker-controlled values out of the SVG content, attributes, and styles that the Node.js ImageResponse renders [12].
What to watch
- Whether Vercel states that apps on its own hosting were protected, as it did for the two critical Next.js flaws fixed in August.
- Publication of the CVE record and a GitHub Advisory Database entry, which would let dependency scanners surface affected versions.
- Any clarification of whether attacker text in ordinary elements, not just an SVG title element, is exploitable, and any public exploit code.