Next.js 16.3.6 patches critical ImageResponse SVG vulnerability
Vercel has released Next.js 16.3.6 to address CVE-2026-94545, a critical vulnerability in the framework’s ImageResponse feature that could enable server-side code execution. Vercel assigned the issue a CVSS score of 9.5. It affects Next.js versions 16.2.0 through 16.3.5 when ImageResponse runs on the Node.js runtime, which is the framework’s default runtime.
The flaw is relevant to applications that place attacker-controlled values into SVG content, attributes or styles during image generation. ImageResponse is commonly used to produce Open Graph and other social-preview images. Vercel said an attacker-controlled value, such as text taken from a request URL, can create risk when it reaches the SVG generated by the feature.
How the ImageResponse issue arises
ImageResponse uses Vercel’s Satori library to turn an image layout into SVG before the final PNG is generated. Satori’s own advisory says certain values could reach SVG output without correct escaping. A specially crafted value could therefore be interpreted as SVG code rather than plain text.
In a Next.js application, Vercel said that condition could reach vulnerabilities in other, unnamed libraries used by Next.js and result in code execution. The advisory example places a value from a request URL in an SVG title element. It does not clarify whether text rendered in ordinary elements, such as a heading inside a div, is within the same exposure condition.
Teams can locate relevant use of the capability by looking for ImageResponse imports from next/og, including in route handlers and opengraph-image files. Route handlers generate the image when a request arrives. An opengraph-image file can generate output at build time or in response to a request.
Patch status and operational checks
Version 16.3.6 is the only patched Next.js release identified in Vercel’s advisory. Applications on the affected 16.2 line need to move to 16.3.6 because the npm registry had no fixed 16.2 release as of September 23. Next.js 15 is not affected, although version 15.5.26 adds additional security hardening for next/og on the 15.5 line.
The Edge implementation of ImageResponse is unaffected, but Vercel’s workaround does not recommend moving to it and Next.js documentation marks the Edge runtime as deprecated. Where an immediate upgrade is not possible, Vercel advises keeping attacker-controlled values out of the SVG content, attributes and styles rendered by Node.js ImageResponse.
As of September 23, there were no public reports of exploitation and no public exploit code. The Hacker News also found that npm audit did not flag the affected 16.3.5 release, while neither the GitHub Advisory Database nor a published CVE record listed the issue at that time. Satori is bundled within the Next.js package, so its presence may not appear as a direct Next.js dependency in a lockfile.
What development and security teams should do
Developers using Satori directly should update to version 0.33.5, which contains the fix. Vercel has not stated whether applications hosted on Vercel receive protection without an upgrade, nor has it provided a method to determine whether a vulnerable route was abused before patching.
The practical response is to inventory ImageResponse routes, verify the deployed Next.js version rather than relying solely on automated audit output, upgrade affected applications to 16.3.6, and review every path through which untrusted request data can enter generated SVG output.