Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.
← back | CVE Intelligence

CVE-2026-94545 [Critical]

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-94545.

Vendor
Vercel
Product
Next.js
Affected versions
>= 16.2.0, < 16.3.6
CVSS
9.5
Coverage Span
2026-09-22
Reports
1 related reports

Associated Reports & Timeline

1.
[CVE-2026-94545] Remote Code Execution in next/og ImageResponse
github.com | advisory | Critical | | original ↗ | #rce | #github | #poc | #nextjs
A critical remote code execution vulnerability (CVE-2026-94545) affects the Node.js ImageResponse implementation in Next.js next/og due to an upstream dependency flaw. When applications pass attacker-controlled values into SVG content, attributes, or styles during dynamic image generation, remote code execution can be triggered. Edge ImageResponse runtimes are not affected. Patched in Next.js 16.3.6.
Why it matters: Dynamic Open Graph image generation is common in Next.js apps; any route accepting user parameters to customize SVG cards could lead to full Node.js server compromise.