Next.js users must urgently address a newly disclosed severity-level bug—identified as CVE-2026-94545—that enables remote code execution through weaponized SVG content. The vulnerability exists in the Node.js ImageResponse component within the next/og package and impacts Next.js versions 16.2.0 up to 16.3.5. The fix was released in version 16.3.6.
What’s Broken and How It’s Exploited
The weakness resides in how dynamically generated images—such as Open Graph previews or social media cards—are rendered when untrusted input is incorporated into SVG elements, attributes, or styles. If an attacker can influence input—say via URL parameters, form data, or APIs—and that data gets injected unchecked into an SVG (for example, into a <title> node), the rendering routine may be hijacked to execute arbitrary server-side code.
Exploitation is jabbed under quite accessible conditions. No authentication is needed, no user clicks, no privileged access. At its heart, the bug lets bad actors submit malicious SVG snippets via endpoints using the Node.js ImageResponse, triggering code execution once parsed and processed by the server. The severity is rated Critical under CVSS v4, given the risk to confidentiality, integrity, and availability.
Who’s Affected & What to Do Now
All Next.js apps running versions 16.2.0 through 16.3.5 using the Node.js implementation of ImageResponse and incorporating user-controlled values into SVG content are vulnerable. On the other hand, deployments using the Edge implementation of ImageResponse or those that never insert untrusted data into any SVG content, attributes or CSS styles are not at risk.
Developers should update to Next.js 16.3.6 immediately. Beyond that, audit all image-generation endpoints—especially those generating Open Graph images that accept query-string or other external input. If patching isn’t possible instantly, stop embedding user-supplied input into SVG elements or styles. Be cautious: even well-meaning input validation might miss complex SVG parsing ambushes.
The flaw was uncovered by researchers RaghavMaheshwari124 and rafabd1. The advisory stems from a GitHub notice labeled GHSA-vcvr-r3jv-pc5j.
