Remote Code Execution in Next.js next/og Node.js ImageResponse via Satori SVG Escaping

CVE-2026-94545 is an unauthenticated remote code execution vulnerability in the Node.js ImageResponse implementation within next/og, the Next.js module responsible for generating Open Graph social-preview images. The root cause lives upstream in Satori (versions ≥0.0.27 <0.33.5), Vercel's JSX-to-SVG rendering library, which fails to properly escape certain values before embedding them in generated SVG output. When a Next.js 16.2.0–16.3.5 application passes attacker-controlled data — such as URL search parameters — into SVG content, attributes, or styles rendered by ImageResponse, the unescaped values are interpreted as live SVG markup. This injected markup then triggers code execution through *other upstream dependencies* in the Node.js SVG processing pipeline. The Edge runtime variant of ImageResponse is not affected, and Next.js 15.x is not vulnerable to the RCE (though 15.5.26 adds related hardening). Fixed in Next.js 16.3.6 and Satori 0.33.5.

Vercel's own advisory (GHSA-vcvr-r3jv-pc5j) rates this CRITICAL at CVSS 4.0 9.5, while the underlying Satori advisory (GHSA-wx4j-mvgx-mqwp) is rated only Moderate at 5.3. The gap reveals the real story: Satori's SVG injection alone is a moderate output-escaping flaw, but *in the specific context of Next.js Node.js ImageResponse and its dependency chain*, the injection escalates to full RCE. The 9.5 score is defensible for the subset of apps that wire untrusted input into ImageResponse, but it overstates the risk for the broader Next.js installed base. Many deployments never use ImageResponse; many that do use static content or the Edge runtime. The affected version window is narrow — only Next.js 16.2.0 through 16.3.5, released over roughly four months in mid-2026. Enterprise teams still on 14.x or 15.x are entirely unaffected. The CRITICAL label will cause unnecessary panic for the majority of Next.js operators while being absolutely appropriate for the minority running vulnerable OG-image endpoints with dynamic user input.

1. Upgrade to Next.js 16.3.6 immediately — This is the definitive fix. The upgrade patches both the Satori SVG escaping flaw and the vulnerable upstream dependencies. Deploy within 30 days per the noisgate remediation SLA for HIGH severity. Given the RCE impact and likelihood of PoC emergence, prioritize this over the 30-day window if possible.
2. Audit all ImageResponse handlers for user-controlled input — Search your codebase for ImageResponse usage and trace whether any searchParams, params, headers, cookies, or other request-derived values flow into SVG content, attributes, or styles. If they do and you cannot immediately upgrade, remove the user-controlled interpolation or replace it with a static/allow-listed value. This is Vercel's official workaround.
3. Switch affected ImageResponse endpoints to Edge runtime — Add export const runtime = 'edge' to route files containing ImageResponse handlers. The Edge ImageResponse implementation is not vulnerable to this RCE. This provides immediate risk elimination while you plan the version upgrade. Deploy within 30 days per noisgate mitigation SLA.
4. Deploy WAF rules to block SVG injection in OG image endpoint parameters — Add WAF rules on your edge/CDN layer (Cloudflare, AWS WAF, Akamai) to detect and block SVG-like markup (<svg, <foreignObject>, <script>, javascript:, xmlns) in query parameters targeting your OG image endpoints (e.g., /api/og, /opengraph-image). This is defense-in-depth — it may not catch all payloads but raises the bar. Deploy within 30 days.
5. Enforce least-privilege for Node.js application processes — Ensure Next.js processes run as non-root, with minimal filesystem permissions and no access to host-level secrets beyond what the application requires. Use container isolation (read-only root filesystem, no-new-privileges, dropped capabilities) to limit post-exploitation impact.

Run this script on any machine with access to the target application's source directory (CI runner, build server, or developer workstation). Invoke with the path to the Next.js project root: bash check_cve_2026_94545.sh /path/to/nextjs-project. No elevated privileges required — it reads package.json and node_modules only.

#!/usr/bin/env bash
# check_cve_2026_94545.sh — Detect CVE-2026-94545 (Next.js ImageResponse RCE)
# Usage: bash check_cve_2026_94545.sh /path/to/nextjs-project
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

PROJECT_DIR="${1:-.}"
RESULT="UNKNOWN"

if [ ! -d "$PROJECT_DIR" ]; then
  echo "[!] Directory not found: $PROJECT_DIR"
  echo "UNKNOWN"
  exit 2
fi

# Determine Next.js installed version
NEXT_VERSION=""
if [ -f "$PROJECT_DIR/node_modules/next/package.json" ]; then
  NEXT_VERSION=$(grep '"version"' "$PROJECT_DIR/node_modules/next/package.json" | head -1 | sed 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/')
elif [ -f "$PROJECT_DIR/package-lock.json" ]; then
  NEXT_VERSION=$(python3 -c "
import json, sys
with open('$PROJECT_DIR/package-lock.json') as f:
    lock = json.load(f)
    pkgs = lock.get('packages', lock.get('dependencies', {}))
    for key in pkgs:
        if key.endswith('/next') or key == 'next':
            print(pkgs[key].get('version', '')); break
" 2>/dev/null || true)
fi

if [ -z "$NEXT_VERSION" ]; then
  echo "[!] Could not determine Next.js version in $PROJECT_DIR"
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Detected Next.js version: $NEXT_VERSION"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$(echo "$NEXT_VERSION" | sed 's/-.*//')"
MAJOR=${MAJOR:-0}; MINOR=${MINOR:-0}; PATCH=${PATCH:-0}

# Check if version is in vulnerable range: >=16.2.0 and <16.3.6
if [ "$MAJOR" -lt 16 ]; then
  echo "[+] Next.js $NEXT_VERSION is below 16.x — not affected by CVE-2026-94545."
  RESULT="PATCHED"
elif [ "$MAJOR" -gt 16 ]; then
  echo "[+] Next.js $NEXT_VERSION is above 16.x — likely patched."
  RESULT="PATCHED"
elif [ "$MAJOR" -eq 16 ]; then
  if [ "$MINOR" -lt 2 ]; then
    echo "[+] Next.js $NEXT_VERSION is below 16.2.0 — not affected."
    RESULT="PATCHED"
  elif [ "$MINOR" -eq 2 ]; then
    echo "[!] Next.js $NEXT_VERSION is in vulnerable range (16.2.x)."
    RESULT="VULNERABLE"
  elif [ "$MINOR" -eq 3 ] && [ "$PATCH" -lt 6 ]; then
    echo "[!] Next.js $NEXT_VERSION is in vulnerable range (16.3.0-16.3.5)."
    RESULT="VULNERABLE"
  else
    echo "[+] Next.js $NEXT_VERSION is >=16.3.6 — patched."
    RESULT="PATCHED"
  fi
fi

# If vulnerable, check for ImageResponse usage
if [ "$RESULT" = "VULNERABLE" ]; then
  echo "[*] Checking for ImageResponse usage in source files..."
  OG_USAGE=$(grep -rl 'ImageResponse\|next/og\|@vercel/og' "$PROJECT_DIR/src" "$PROJECT_DIR/app" "$PROJECT_DIR/pages" 2>/dev/null | head -20 || true)
  if [ -n "$OG_USAGE" ]; then
    echo "[!] ImageResponse / next/og usage found in:"
    echo "$OG_USAGE" | while read -r f; do echo "    $f"; done
    echo ""
    echo "[!] Check whether these files pass user-controlled input (searchParams, headers, etc.) into ImageResponse SVG content."
  else
    echo "[*] No ImageResponse / next/og usage detected in src/, app/, or pages/ directories."
    echo "[*] If ImageResponse is not used, this deployment is not exploitable (but upgrading is still recommended)."
  fi
fi

echo ""
echo "$RESULT"
exit $([ "$RESULT" = "PATCHED" ] && echo 0 || ([ "$RESULT" = "VULNERABLE" ] && echo 1 || echo 2))

1. Vercel Next.js Security Advisory (GHSA-vcvr-r3jv-pc5j)
2. Satori SVG Escaping Advisory (GHSA-wx4j-mvgx-mqwp)
3. Next.js Official Security Update Blog Post
4. Netlify Advisory — Next.js ImageResponse Vulnerability
5. HOL Guard Threat Campaign — GHSA-vcvr-r3jv-pc5j
6. SecurityOnline — Next.js RCE Vulnerability CVE-2026-94545 Fixed
7. W3Techs — Next.js Usage Statistics (Sep 2026)
8. Nuxt OG Image Satori Fix PR