Next.js 16.3.6 fixes a critical next/og RCE: who is exposed

Next.js 16.3.6 fixes a critical remote code execution vulnerability in next/og. The advisory, GHSA-vcvr-r3jv-pc5j (CVE-2026-94545), was published on 22 September 2026 with a CVSS 4.0 score of 9.5. It affects Next.js from 16.2.0 up to but not including 16.3.6, and only one code path: the Node.js implementation of ImageResponse, when attacker-controlled values reach SVG content, attributes or styles during image generation. If that describes any route you run, upgrade today. If it does not, upgrade anyway, but you can read the rest first.

Vercel announced the out-of-band release a day early, without details, and asked teams to upgrade to 16.3.6 or 15.5.26 as soon as they were available. Both are now on npm. Here is what the advisory actually says, how to tell whether you were exposed, and the part that also applies to teams that never touch next/og.

What the Next.js 16.3.6 advisory covers

Field	Value
Advisory	GHSA-vcvr-r3jv-pc5j, "Remote Code Execution in next/og ImageResponse"
CVE	CVE-2026-94545
Severity	Critical, CVSS 4.0 score 9.5
Affected	>= 16.2.0 < 16.3.6
Patched	16.3.6
Not affected	The Edge implementation of ImageResponse

The advisory describes the cause as an upstream vulnerability in the dependency that the Node.js ImageResponse uses, and says it "can lead to remote code execution". The condition is specific: applications that pass attacker-controlled values into SVG content, attributes, or styles during image generation. The stated workaround, if you cannot upgrade immediately, is to stop doing exactly that.

The version range matters. Only the 16.2 and 16.3 lines are listed as affected. Vercel's announcement also named 15.5.26 as part of the same out-of-band update, and that release shipped the same day, so if you are on 15.x the instruction from Vercel is to move to 15.5.26. The advisory we read does not list a 15.x range, so we would not treat a 15.x app as confirmed exposed, only as due an upgrade.

The upstream: Satori

The same CVE appears on a Satori advisory, GHSA-wx4j-mvgx-mqwp, published the same day. Satori is the library that turns JSX-like markup into SVG, and it is what next/og builds on. Its advisory is short: Satori "does not properly escape certain values before including them in generated SVG output", so crafted values can be interpreted as SVG markup. Affected versions are 0.0.27 up to but not including 0.33.5, patched in 0.33.5, rated moderate with a CVSS 4.0 score of 5.3.

The gap between those two scores is the useful part. On its own, Satori produces a string of SVG with markup where there should have been text. Whether that becomes serious "depends on how the generated SVG is consumed", in the advisory's words. In Next.js's Node.js image path, what consumes it turned a moderate escaping bug into a critical one. This is the same shape of failure we wrote about in the JSON-LD escape most sites skip: a value that was meant to be data is allowed to become structure.

Were you exposed?

Work through three questions for every route that generates an image.

1. Do you use ImageResponse from next/og? Search the codebase for next/og and for opengraph-image and twitter-image route files. No hits means this advisory does not reach you through Next.js.
2. Does it run on the Node.js runtime? The Edge implementation is stated as unaffected. A route that does not set the Edge runtime runs on Node.js by default in the App Router, so check each route rather than assuming.
3. Can a visitor influence what goes into the image? This is the common case, not the rare one. Dynamic social images are usually built from a query parameter, a post title, a username or a product name. If any of those can be set by someone outside your team, including user-generated titles stored in your own database, treat the route as exposed until patched.

If all three answers are yes and you ran 16.2.0 or later before patching, assume the route was reachable and review what that server could access. The advisory does not say whether the issue has been exploited, and we will not guess.

How to upgrade safely

The fix is a version bump, but check that the version you think you shipped is the one running.

1. Move next to 16.3.6, or to 15.5.26 if you are on the 15.x line, and reinstall so the lockfile updates.
2. Check what your lockfile resolves for satori and @vercel/og. Satori is fixed in 0.33.5; @vercel/og published 1.0.3 the same afternoon. Anything you install directly will not be upgraded for you by the Next.js bump.
3. Rebuild and redeploy every environment that serves traffic, including previews that are publicly reachable.
4. Confirm the deployed version from the build output or the running app, not from your package file.
5. Until you can deploy, apply the stated workaround: stop passing untrusted values into image generation, or move the route to the Edge runtime if it works there.

If you use Satori directly

This is the part most write-ups will skip. Plenty of teams render images with Satori directly, without next/og: banner generators, certificate and invoice previews, social cards built in a background job. None of them are covered by the Next.js upgrade, and all of them fall inside the Satori advisory's range until the package itself is updated.

We are in that group. The cover images on this blog are rendered by our own pipeline with Satori and resvg, not through next/og, so the Next.js advisory does not apply to us but the Satori one does. The inputs to that renderer are headlines and figures we write ourselves rather than visitor input, which keeps the practical risk low, but "we control the input today" is a weak reason to keep a known escaping bug. Satori's advisory is blunt that there is no complete workaround besides upgrading, and that applications that cannot upgrade should not render attacker-controlled content with it.

The same logic applies to anything else that turns user input into a rendered file. We made the case for treating image pipelines as attack surface after the HEIC parsing issue, and the lesson carries: the dependency you think of as a formatting helper is often the one sitting closest to untrusted data. Keeping it on a patched version is part of the same discipline as watching what your build pulls in.

The short version

Upgrade to Next.js 16.3.6 or 15.5.26 now. If you generate images from anything a visitor can influence on the Node.js runtime, treat those routes as having been exposed. If you use Satori directly, upgrade it to 0.33.5 separately, because the framework bump will not do it for you. If you would like a second pair of eyes on which of your routes are reachable, that is routine work for our web application team.