Security2 hOctober 14, 2026, 05:11

Critical CVE-2026-94545 hits Next.js next/og and Satori

A critical CWE-116 flaw rated CVSS 9.5 was found in Next.js next/og and Vercel's Satori: unescaped characters in SVG output let attackers inject arbitrary tags, leading to SSRF or RCE. It is fixed in Next.js 16.3.6 and Satori 0.33.5; the Edge runtime and Next.js 15 are unaffected.

DEV Community

Open source

Critical CVE-2026-94545 hits Next.js next/og and Satori

Affects Next.js 16.2.0–16.3.5 and Satori 0.0.27–0.33.4
CVSS 9.5 (Critical); Satori's advisory cites up to 9.8
Exploitable without authentication via public OG endpoints
Fixed in Next.js 16.3.6 and Satori 0.33.5

#Next.js#Vercel#Satori

Next.js ships v16.3.6 and v15.5.26 with next/og security patches

Security

Critical Next.js ImageResponse flaw allows server code execution

Security

CVE-2026-29057: HTTP request smuggling via Next.js rewrites

Security

Critical CVE-2026-94545 hits Next.js next/og and Satori

Next.js ships v16.3.6 and v15.5.26 with next/og security patches

Critical Next.js ImageResponse flaw allows server code execution

CVE-2026-29057: HTTP request smuggling via Next.js rewrites

Satori and Next.js SVG escaping flaw led to RCE risk