Next.js ImageResponse CVE-2026-94545: A 9.5 CVSS Server Code Execution Hiding in Your OG Images

As reported by The Hacker News, Vercel disclosed a critical server-side code execution vulnerability in Next.js's ImageResponse feature on September 22, 2026. The flaw — CVE-2026-94545, rated CVSS 9.5 — is the kind of vulnerability that should make security teams pause, not because the attack vector is exotic, but because it sits in functionality that developers routinely feed user-controlled data into without a second thought.

Vulnerability Summary

Why This Matters More Than It Looks

The vulnerability lives in ImageResponse from next/og, a feature widely used to dynamically generate Open Graph images — the social preview thumbnails that appear when links are shared on Slack, Twitter, LinkedIn, and elsewhere. The common pattern is to pull a slug, query parameter, or path segment from the request URL and inject it as text into the generated image. That is precisely the pattern Vercel's advisory flags as vulnerable.

What elevates this beyond a typical injection bug is the chain: ImageResponse uses Vercel's Satori library to convert layout definitions into SVG, which is then rasterized to PNG. If attacker-controlled strings can break out of the intended SVG structure and inject arbitrary SVG content, attributes, or styles, the resulting payload executes in the Node.js server context during rendering. Server-side code execution from a crafted URL is about as severe as web vulnerabilities get.

The danger is not theoretical — it is architectural. Any Next.js 16.2+ app that renders dynamic OG images from request data on the Node.js runtime is a candidate for exploitation.

Who Is Most Exposed

• Content platforms and CMS-driven sites that generate per-article OG images from URL slugs or titles
• E-commerce applications rendering product preview cards with user-generated product names or reviews
• Community and forum apps where usernames, post titles, or tags flow into social share images
• Any deployment running Next.js 16.2.0 through 16.3.5 on the Node.js runtime with opengraph-image route handlers

Notably, the Edge runtime variant is unaffected — but Vercel has marked the Edge runtime as deprecated, making that escape hatch a poor long-term mitigation.

The Detection Gap

One of the more concerning aspects The Hacker News surfaced: as of September 23, npm audit did not flag Next.js 16.3.5 as vulnerable, the GitHub Advisory Database had no entry, and no CVE record had been published. This means automated dependency scanning tools — including Snyk, Dependabot, and similar platforms that rely on advisory feeds — may not alert on this flaw for hours or days. Security teams cannot rely on tooling alone right now; manual version checks are essential.

Shield53 Recommendations

Immediate Actions

• Patch now: Run npm install next@16.3.6 across all environments. This is the only fixed release; there is no patched 16.2.x version.
• Audit your codebase: Search for ImageResponse imports from next/og in route handlers and opengraph-image files. For each usage, trace whether any value derived from the request (URL params, query strings, headers, cookies) reaches the image content.
• Apply input isolation as an interim control: If upgrading must wait, ensure no attacker-controlled values are passed into SVG content, attributes, or styles. Sanitize or hardcode dynamic text, or fetch it from trusted server-side stores rather than request data.
• Verify version manually: Check package.json and node_modules/next/package.json directly — do not trust npm audit at this time.
• Inventory Satori exposure: Satori is bundled inside the Next.js package and will not appear as a separate dependency in your lockfile. Treat any Next.js 16.2–16.3.5 installation as potentially vulnerable regardless of lockfile appearance.
• Deploy WAF rules: If your OG image routes accept URL parameters, consider rate-limiting and input-length constraints on those endpoints as a compensating control until patching is verified.

Broader Implications

This vulnerability underscores a recurring pattern in modern web frameworks: features designed for developer convenience — dynamic image generation, server-side rendering, edge functions — expand the attack surface in ways that are easy to overlook during code review. The fact that a social preview image generator can become a server code execution vector illustrates how seemingly benign output paths can become injection points when they process untrusted input through complex rendering pipelines.

For organizations running Next.js at scale, this is also a reminder that the gap between vendor disclosure and advisory database propagation can be measured in days. Your incident response and patch management processes should account for that window — because adversaries certainly will.