[CVE-2026-94545] Remote Code Execution in next/og ImageResponse

A critical remote code execution vulnerability (CVE-2026-94545) affects the Node.js ImageResponse implementation in Next.js next/og due to an upstream dependency flaw. When applications pass attacker-controlled values into SVG content, attributes, or styles during dynamic image generation, remote code execution can be triggered. Edge ImageResponse runtimes are not affected. Patched in Next.js 16.3.6.

Dynamic Open Graph image generation is common in Next.js apps; any route accepting user parameters to customize SVG cards could lead to full Node.js server compromise.