Vercel Patches Critical Next.js ImageResponse RCE Traced to a Satori SVG-Escaping Flaw

Overview

Vercel shipped an out-of-band security release for Next.js on September 22, 2026, patching a critical remote code execution vulnerability in ImageResponse, the framework’s built-in image-generation feature, according to the Next.js security update. The flaw, tracked as CVE-2026-94545 and rated 9.5 (Critical), traces back to an escaping bug in Satori, the Vercel-maintained library that next/og uses to convert layouts into SVG before rendering a final image, according to the GitHub Security Advisory.

What We Know

• ImageResponse, imported from next/og, is the feature developers use to generate Open Graph and other social preview images, according to The Hacker News.
• The vulnerability affects Next.js versions from 16.2.0 up to (but not including) 16.3.6, and only when ImageResponse runs on the Node.js runtime — the default — according to the Next.js advisory.
• Vercel’s advisory says affected applications “pass attacker-controlled values into SVG content, attributes, or styles during image generation.” Its published proof-of-concept shows a value read from a URL query parameter placed directly inside an SVG <title> element, according to the GitHub Security Advisory.
• Applications using the Edge runtime implementation of ImageResponse are not affected, and neither is Next.js 15.x. Vercel still released Next.js 15.5.26 the same day with what it calls “related hardening,” according to the Next.js blog post.
• The root cause sits in Satori itself: versions 0.0.27 up to (but not including) 0.33.5 do not “properly escape certain values before including them in generated SVG output,” according to Satori’s own advisory, published the same day and rated 5.3 (Moderate) because its impact “depends on how the generated SVG is consumed.”
• Both the Next.js and Satori advisories credit the same two researchers, RaghavMaheshwari124 and rafabd1, as finders, according to the GitHub Security Advisory.
• The fix ships as Next.js 16.3.6, installable with npm install [email protected], with Satori 0.33.5 available separately for applications that depend on it directly, according to the Next.js blog post.
• For teams that cannot upgrade immediately, Vercel’s advisory recommends not passing attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation, according to the GitHub Security Advisory.
• The affected code path has existed since Next.js 16.2 was released on March 18, according to The Hacker News and the v16.2.0 release tag — the same version previously reported for shipping agent devtools and faster server rendering.

What We Don’t Know

• As of September 23, The Hacker News said it had found no public reports of attacks exploiting the flaw and no public exploit code, according to The Hacker News.
• Vercel’s advisory does not name the “other upstream dependencies” through which Satori’s escaping bug can be turned into remote code execution, according to the GitHub Security Advisory.
• Neither the Next.js blog post nor the advisory states whether applications hosted directly on Vercel’s own platform were automatically protected without a manual upgrade.