Vercel Patches Critical Next.js ImageResponse RCE Traced to a Satori SVG-Escaping Flaw
Vercel shipped Next.js 16.3.6 to fix a critical, 9.5-rated remote code execution flaw in ImageResponse rooted in a Satori SVG-escaping bug, CVE-2026-94545.
Signal
5 articles covering "Next.js"
Vercel shipped Next.js 16.3.6 to fix a critical, 9.5-rated remote code execution flaw in ImageResponse rooted in a Satori SVG-escaping bug, CVE-2026-94545.
The React team merged a work-in-progress Rust rewrite of the React Compiler, and Vercel says early Turbopack tests found 20-50% faster compilation.
Next.js 15.5.18 and 16.2.6 land with a 13-advisory bundle covering a React Server Components DoS (CVE-2026-23870), middleware-bypass routes, SSRF, and cache poisoning; Vercel says the WAF cannot reliably block them.
Vercel's Next.js 16.2 delivers an 87 percent reduction in dev server startup time, up to 60 percent faster rendering via a React contribution, and introduces experimental tooling that gives AI coding agents direct access to browser DevTools and component trees from the terminal.
Vercel releases Next.js 16.2 with experimental AI agent tooling, a React contribution that speeds up Server Component rendering by up to 350 percent, Turbopack Server Fast Refresh, and over 200 bug fixes.