A critical security vulnerability in Next.js can allow remote code execution when applications using the Node.js implementation of next/og ImageResponse embed attacker-controlled data in SVG content, attributes, or styles.
The issue, tracked as GHSA-vcvr-r3jv-pc5j, affects Next.js versions 16.2.0 through 16.3.5 and has been fixed in version 16.3.6. The vulnerability stems from an upstream issue in Vercel’s Satori SVG-generation library, which is used in the image-rendering pipeline behind ImageResponse.
Satori failed to correctly escape certain values before incorporating them into generated SVG output, potentially allowing specially crafted input to be interpreted as active SVG markup rather than harmless text.
Critical Next.js ImageResponse Flaw
The upstream issue is tracked as CVE-2026-94545 and affects Satori versions 0.0.27 through 0.33.4; it was remediated in Satori 0.33.5.
Next.js applications are vulnerable when they use the Node.js runtime for next/og image generation and directly place user-supplied values within SVG elements.
A typical vulnerable implementation may read a query-string parameter and inject it into an SVG <title> element while creating a dynamic Open Graph image.
Although this pattern is often used for social preview images, attacker-controlled input can traverse the underlying SVG rendering chain in a way that leads to code execution on the image-generation server.
The advisory assigns the flaw a critical CVSS v4 rating. Exploitation is possible remotely over the network, requires low attack complexity, and requires no privileges or user interaction.
The attack does require a vulnerable application to expose an image-generation endpoint that passes untrusted data into SVG output.
The risk is especially significant for deployments that dynamically generate Open Graph cards, profile images, campaign banners, document previews, or branded social-media graphics from URL parameters or API-controlled values.
An unauthenticated attacker may be able to submit malicious SVG-related content through a request parameter, depending on the endpoint’s input handling and the deployed runtime.
Not every use of ImageResponse is affected. Applications using the Edge implementation of ImageResponse are outside the affected scope. Likewise, Node.js-based applications that do not pass attacker-controlled values into SVG content, SVG attributes, or inline styles are not vulnerable through this attack path.
Organizations should update Next.js to version 16.3.6 immediately. The update incorporates the upstream remediation needed to prevent untrusted values from being improperly handled in the SVG image-generation flow.
Teams should also review all next/og routes, particularly endpoints that obtain text, markup-like strings, style values, colors, URLs, or other rendering inputs from query parameters, request bodies, cookies, headers, databases, or external APIs.
Where immediate patching is impossible, developers should remove attacker-controlled data from SVG content, attributes, and styles rendered by the Node.js ImageResponse implementation.
This is only a temporary mitigation: the upstream Satori advisory states that there is no complete workaround beyond upgrading, and applications should avoid rendering untrusted content with the affected library.
Security teams should prioritize internet-facing Next.js deployments and inspect logs for unusual requests targeting dynamic OG-image endpoints, particularly requests containing SVG tags, XML-like payloads, encoded markup, or suspicious style expressions.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
