On September 22, 2026, Vercel shipped an out-of-band security release for Next.js — versions 16.3.6 and 15.5.26 — to fix a critical remote code execution vulnerability in next/og, the framework's built-in dynamic image generation API. The flaw, tracked as CVE-2026-94545 (GHSA-vcvr-r3jv-pc5j) with a CVSS score of 9.5, affects the Node.js runtime implementation of ImageResponse in Next.js versions 16.2.0 through 16.3.5. The day after, Vercel gave advance notice of a second, already-scheduled release for September 30, 2026 (versions 16.3.7 and 15.5.27) bundling nine further fixes: one critical, two high, five medium, one low.
What actually broke
next/og is the API Next.js ships for generating Open Graph images, social cards, and other dynamic PNGs/SVGs on the server, typically at request time from a route handler. Under the hood, the Node.js runtime path renders those images through Satori, Vercel's own JSX-to-SVG library. According to the advisory, certain values reached Satori's SVG output without being properly escaped. If an application passes attacker-controlled input — a query parameter, a URL segment, anything derived from the request — into SVG content, attributes, or styles during image generation, that unescaped value can, under specific conditions, be turned into remote code execution rather than just a rendering glitch or an XSS-style injection.
Concretely: a title, caption, or username pulled from a request URL and dropped into an SVG <title> or similar element inside an ImageResponse call is the shape of the exploit path Vercel describes. That's an extremely common pattern — "generate a social card with the article title from the slug" is close to the canonical next/og use case shown in Next.js's own documentation.
Two things narrow the blast radius considerably:
- Only the Node.js runtime is affected. If your route handler runs
ImageResponseunder the Edge runtime, you're not exposed to the RCE. - Next.js 15 is not affected by the RCE. Vercel shipped 15.5.26 anyway, but that release is hardening only — the underlying vulnerability doesn't reach 15.x.
So the exposure is specifically: Next.js 16.2.0–16.3.5, next/og on Node.js, with attacker-influenced data flowing into the generated SVG. Vercel's fix upgrades the Satori dependency (to 0.33.5) and related upstream packages rather than changing the next/og API surface, so there's no code migration required beyond bumping the package version.
The fix, and why it went out-of-band
npm install next@16.3.6 # for the 16.3 line
npm install next@15.5.26 # for 15.5 — hardening only, no RCE fix neededVercel classifies this as an out-of-band release specifically because it's a critical-severity issue with an active upstream advisory (the companion Satori advisory is GHSA-wx4j-mvgx-mqwp) — it didn't wait for a scheduled security window. That's a meaningfully different signal than routine patch-Tuesday-style releases: Vercel runs those on a announced cadence (there was a scheduled release in July 2026, for instance), and going off-cycle for a single CVE is reserved for things they consider urgent enough that a week's delay is unacceptable.
The bundling of the vulnerability report says exploitation requires "specific conditions" — Vercel hasn't published a full proof-of-concept, and no in-the-wild exploitation had been reported as of this writing. That's typical for a coordinated disclosure: enough detail to patch and assess exposure, not enough to hand attackers a working exploit before most of the ecosystem has upgraded.
A second release is already queued
What's notable about the sequence here is that Vercel didn't just patch and move on. On September 23, 2026 — the day after the out-of-band fix — they published advance notice that a second, separately scheduled security release is coming September 30, 2026, covering nine additional vulnerabilities across the same 16.3.x and 15.5.x lines: one critical, two high, five medium, one low. As of this writing, that release hasn't shipped and the specific CVEs, affected components, and exploit conditions for those nine issues haven't been disclosed — Vercel is following its practice of giving upgrade lead time before publishing full advisories.
Two unrelated security releases landing eight days apart on the same framework is not, by itself, evidence of a supply-chain-scale crisis — Next.js has had scheduled security releases before (July 2026, for example) as a matter of routine maintenance. But it does mean teams running Next.js 16.x in production have two separate upgrade cycles to plan for in the same week, not one.
What this changes
If you run any Next.js app on 16.2.0–16.3.5 and use next/og with the Node.js runtime, treat this as urgent: upgrade to 16.3.6 (or later) now, and audit any ImageResponse calls where request-derived values — slugs, query params, headers — flow into SVG content, attributes, or inline styles. If those values are static or hardcoded, your exposure was low regardless. If you're on the Edge runtime for ImageResponse, or on Next.js 15, this particular CVE doesn't reach you, though the 15.5.26 hardening release is still worth taking.
The more durable takeaway is procedural, not technical: don't patch once and consider Next.js security "done" for the month. With a second release already announced for September 30 covering nine more issues, teams should plan to re-check and re-upgrade again within the week rather than treating the September 22 patch as the end of the story. If you maintain a Next.js app with any kind of scheduled deploy cadence, this is a good week to move security patches out of the regular release train and apply them as soon as they land.
This is also a reminder that "we don't handle user input in that code path" is a claim worth re-verifying rather than assuming — the exploit condition here (request-derived values reaching SVG output) is easy to introduce incidentally, for example by templating an og:image title from a dynamic route parameter without thinking of it as "user input" at all.
Wise Hustlers builds and maintains production Next.js applications, including patch and dependency management as part of ongoing engineering work — see wise-hustlers.com/services for what that looks like in practice.
Sources
- Next.js Security Update for a Critical Upstream Issue — Vercel's official advisory, September 22, 2026
- Upcoming Next.js September Security Release — advance notice of the September 30, 2026 release
- Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input — The Hacker News coverage with CVE-2026-94545 details
- GHSA-vcvr-r3jv-pc5j — Next.js GitHub security advisory
- GHSA-wx4j-mvgx-mqwp — companion Satori upstream advisory