Next.js applications using ImageResponse on the Node.js runtime need an immediate version check and, if affected, an upgrade to 16.3.6. CVE-2026-94545 can lead to server code execution when an application passes attacker-controlled data into SVG content, attributes, or styles during image generation; the affected range is Next.js 16.2.0 through 16.3.5, and Vercel rates the issue critical with a CVSS score of 9.5. thehackernews.com
For teams doing GEO work, this is not a niche image-pipeline defect to leave with platform engineering. Open Graph image endpoints are often part of the publishing and discoverability stack: they turn page titles, entity names, query parameters, article metadata, and sometimes URL-derived text into shareable preview assets. That makes an image route a likely place for dynamic values to cross a trust boundary. The practical response is two-stage: patch first, then audit every path where untrusted data can reach an SVG generated by next/og.
What changed, and what is actually affected
Vercel fixed the vulnerability on September 22 in Next.js 16.3.6. The issue affects ImageResponse when it runs on Node.js, which Next.js uses by default. The Edge version of ImageResponse is not affected, nor is Next.js 15. thehackernews.com
The relevant implementation detail is that ImageResponse uses Satori to convert an image layout into SVG before the final PNG is generated. Satori’s advisory says certain values could reach SVG output without proper escaping, allowing a specially crafted value to be interpreted as SVG code rather than plain text. In Next.js, Vercel said those values could reach vulnerabilities in other dependencies and result in code execution, although it did not name those libraries. thehackernews.com
That chain matters when scoping the review. The immediate question is not simply whether the project generates Open Graph images. It is whether a Node.js ImageResponse route incorporates a value an attacker can control into the generated SVG’s content, attributes, or styles. The cited advisory example reads a value from the request URL and puts it in an SVG title element. The available reporting does not settle whether ordinary text rendered in elements such as a heading inside a div is also affected. Treat that as an unresolved boundary, not as evidence that those routes are safe. thehackernews.com
Patch before trying to perfect the audit
The patched release identified for affected Next.js applications is 16.3.6. The report states that there was no fixed release for the 16.2 line as of September 23, meaning applications on 16.2 need to move to 16.3.6 rather than wait for a 16.2 patch. The documented installation command is npm install next@16.3.6. thehackernews.com
Do not make a clean npm audit result the gate for this work. In checks reported on September 23, npm audit did not flag Next.js 16.3.5 even though it is in the affected range. The report also says the issue was not yet listed in the GitHub Advisory Database and no CVE record for CVE-2026-94545 had been published at that point. Check the resolved Next.js version directly in the deployment artifact or installed dependency state. thehackernews.com
Likewise, do not use a missing standalone Satori entry in a lockfile as reassurance. Satori is bundled inside the Next.js package, so it may not appear as a dependency of Next.js in that file. Teams using Satori directly have a separate update target: version 0.33.5 contains the fix, according to the Satori advisory summarized in the report. thehackernews.com
Audit routes, not just repositories
A repository-wide search is the correct start, but the useful output is a deployment-aware inventory. Search for ImageResponse imports from next/og. The report specifically identifies route handlers and opengraph-image files as places where the feature is used. Route handlers produce the image when a request arrives; an opengraph-image file may generate an image at build time or on request. thehackernews.com
For each result, trace the values rendered into the image rather than stopping after classifying the route as “metadata.” A practical review list is:
- Request URL values, including path segments and query-derived text, because the published example uses a value read from the URL. thehackernews.com
- Content or entity fields that can be authored, imported, synchronized, or otherwise influenced outside the trusted codebase.
- Values assigned to SVG-facing content, attributes, or styles, which are the categories explicitly described as affected. thehackernews.com
- Build-time generation paths as well as request-time handlers, because the execution timing differs between the supported image mechanisms. thehackernews.com
The second item is an audit discipline rather than a claim about the vulnerability’s exact exploit conditions: the sources only establish attacker-controlled values as the risk category. But for GEO systems, where editorial and structured-data pipelines commonly supply the language used in previews, reviewing data provenance is the fastest way to identify which routes deserve the closest attention.
Mitigation if an upgrade cannot happen immediately
The published workaround is narrow: keep attacker-controlled values out of the SVG content, attributes, and styles rendered by Node.js ImageResponse. thehackernews.com
That is a temporary containment measure, not a substitute for the fixed version. The reporting does not provide a complete list of safe rendering contexts, and it explicitly leaves open whether ordinary text elements are in scope. A team that cannot upgrade should therefore identify exposed ImageResponse routes, remove or stop using untrusted dynamic values in their SVG output, and preserve the route inventory for the post-upgrade review.
The sources also do not support assuming that moving to Edge is an approved remediation. While the Edge ImageResponse implementation is described as unaffected, the advisory reportedly does not recommend switching to it, and Next.js documentation marks the Edge runtime as deprecated. thehackernews.com
Do not overstate what is known after patching
As of September 23, there were no public reports of attacks using this flaw and no public exploit code, according to the report. thehackernews.com
That is useful context, but it is not evidence that an exposed route was never targeted. The Vercel advisory and announcement reportedly provide no method to determine whether an affected route was abused before patching. They also do not say whether applications hosted on Vercel are protected. thehackernews.com
The sensible conclusion is operational rather than speculative: patch the affected Node.js ImageResponse deployment, verify the actual installed version rather than relying on audit tooling, and retain an explicit record of every image route and its inputs. For GEO teams, the lasting lesson is that social-preview generation is executable server-side infrastructure, not merely a presentation layer. Its dynamic copy deserves the same trust-boundary review as any other request-derived server input.