Vercel disclosed a critical remote code execution vulnerability, CVE-2026-94545, in Next.js’s ImageResponse feature on September 22, rated 9.5 on the CVSS scale. The flaw affects Next.js versions 16.2.0 through 16.3.5 when ImageResponse runs on the Node.js runtime, and Vercel shipped a fix the same day in version 16.3.6.
ImageResponse generates the social-preview images a site shows when a link gets shared, and the flaw sits in how the underlying Satori rendering library turns supplied values into SVG output. When an application passes attacker-controlled input, such as text read from a request URL, into a generated image, that value can reach the SVG output without being properly escaped, letting a specially crafted value be interpreted as SVG code rather than plain text and reach code execution through libraries Next.js depends on. Vercel says the Edge runtime implementation of ImageResponse is not affected, and neither is Next.js 15.
The flaw is narrow by configuration, since it only fires when an app actually feeds untrusted input into a generated image, but wide by adoption, since social-preview image generation is close to a default pattern on modern Next.js sites, and unauthenticated RCE rated 9.5 sits behind a feature most teams treat as purely cosmetic. Any site that pipes a URL parameter, a page title, or a query string into an og-image route should treat that input as untrusted regardless of patch status, the same discipline CyberTech has argued applies to widely adopted developer tooling generally, where a single framework-level flaw inherits the blast radius of everyone who built on it, and a reminder that patch timelines on popular infrastructure matter well beyond the vendor’s own user base.
