Critical RCE flaw in Next.js next/og scores 9.5, fixed in 16.3.6

Vercel disclosed CVE-2026-94545, a critical RCE flaw (CVSS 9.5) in Next.js next/og's Node.js ImageResponse caused by improper SVG escaping in Satori, patched in version 16.3.6.

2026-09-23 ~ 2026-09-23 · 3 related posts

• Critical RCE (CVSS 9.5) found in Next.js next/og ImageResponse, patched in 16.3.6 — jedisct1 · 2026-09-23
• Critical Next.js RCE (CVSS 9.5): attacker-controlled SVG in next/og can execute server code — evilsocket · 2026-09-23

1 near-duplicate retellings: evilsocket