Critical Next.js RCE (CVSS 9.5): attacker-controlled SVG in next/og can execute server code
evilsocket · x · 2026-09-23
Vercel disclosed a critical RCE in the Node.js implementation of ImageResponse from next/og (CVE-2026-94545, CVSS 9.5).
- Affects Next.js >=16.2.0 <16.3.6; fixed in 16.3.6
- Exploitable over the network with no auth or user interaction when attacker-controlled values reach SVG content, attributes or styles (e.g. query params rendered into an OG image)
- The Edge ImageResponse implementation is not affected; apps that never put untrusted data into SVG are safe
- Workaround: if you can't upgrade immediately, stop passing attacker-controlled values into the Node.js ImageResponse SVG
Related event: Critical RCE flaw in Next.js next/og scores 9.5, fixed in 16.3.6(3 posts)→
More from Safety
- US data vendors accused of selling RL environments to Chinese military-linked firms — xeophon · 2026-11-11
- LMArena co-founder explains AI evaluation methodology and policy in new podcast — MattPerault · 2026-11-11
- Defending METR: public data can't second-guess its AI speedup findings — peterwildeford · 2026-11-11
- Australia's review of an OpenAI agent's unauthorized Medicare access exposes the agent accountability problem — cmb24k · 2026-11-11
- Adversarial RL envs for backdoor insertion vs. detection: where does it converge? — DimitrisPapail · 2026-11-11
- Using a third-party inference provider with your coding harness hands it shell access to your machine — TheZachMueller · 2026-11-11