Critical Next.js RCE: CVE-2026-94545 hits next/og ImageResponse via Satori SVG escaping flaw
evilsocket · x · 2026-09-23
CVE-2026-94545 is a critical-severity RCE in Next.js's next/og ImageResponse, caused by improper SVG escaping in Satori (CWE-116). Versions >=16.2.0 <16.3.6 are affected; fixed in 16.3.6.
Pruva published a verified, runnable reproduction: the full exploit chain reaches the target end-to-end on the real production code path, with the agent-driven reproduction taking 84 minutes, 476 tool calls, and $17.73 of spend, complete with sandbox proof and artifacts. Developers should upgrade to 16.3.6 immediately.
Related event: Critical RCE flaw in Next.js next/og scores 9.5, fixed in 16.3.6(3 posts)→
More from coding & agent
- User automates entire video clipping workflow with Nous Research's Hermes agent — Teknium · 2026-11-12
- As models improve, writing good evals gets harder and more important — amankhan · 2026-11-12
- Free AI game jam in SF Nov 14–15 with teams from Anthropic, Google, Meshy, OpenAI — chrisfirst · 2026-11-12
- Omarchy 4.6 lets you share local AI models across your tailnet, says DHH — alexcovo_eth · 2026-11-12
- Coding harnesses hand shell access to inference providers — 4-step gateway mitigation — shensi · 2026-11-12
- Slack's David Hoang: agents beat people on coordination, proposes 'boundary agents' — davidhoang · 2026-11-12