---
id: 8800
title: "[CVE-2026-94545] Remote Code Execution in next/og ImageResponse"
cve: CVE-2026-94545
cvss: 9.5
severity: critical
vendor: "Vercel"
product: "Next.js"
affected_versions: ">= 16.2.0, < 16.3.6"
source_domain: github.com
source_url: "https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j"
published_at: "2026-09-22T17:03:51Z"
tags: ["rce", "github", "poc", "nextjs", "vercel"]
phying_url: "https://phying.com/item/8800"
lang: en
---

# [CVE-2026-94545] Remote Code Execution in next/og ImageResponse

## Summary

A critical remote code execution vulnerability (CVE-2026-94545) affects the Node.js ImageResponse implementation in Next.js next/og due to an upstream dependency flaw. When applications pass attacker-controlled values into SVG content, attributes, or styles during dynamic image generation, remote code execution can be triggered. Edge ImageResponse runtimes are not affected. Patched in Next.js 16.3.6.

## Why it matters

Dynamic Open Graph image generation is common in Next.js apps; any route accepting user parameters to customize SVG cards could lead to full Node.js server compromise.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-94545
- **CVSS:** 9.5
- **Vendor:** Vercel
- **Product:** Next.js
- **Affected versions:** >= 16.2.0, < 16.3.6
- **Published:** 2026-09-22T17:03:51Z
- **Original:** https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j
- **Phying News:** https://phying.com/item/8800