Is your Next.js app exposed to CVE-2026-94545?

Your Next.js app is exposed to CVE-2026-94545 only if three things are true. It runs Next.js 16.2.0 through 16.3.5, it calls ImageResponse from next/og on the Node.js runtime, and untrusted input can reach the SVG that ImageResponse builds. If any one of the three is false, this specific remote code execution bug does not reach you. Patching to 16.3.6 is still the right move.

CVE-2026-94545 is a critical remote code execution vulnerability in the Node.js implementation of ImageResponse in Next.js, disclosed in the September 22, 2026 Next.js security update. The Next.js team shipped the fix out of band, meaning outside the normal release schedule. This post walks through the checks, the commands, and the final decision so that you can act on the advisory quickly.

Which Next.js versions are affected?

Next.js versions from 16.2.0 up to, but not including, 16.3.6 are affected. That range comes from the official advisory, which is tracked as GHSA-vcvr-r3jv-pc5j. The fixed releases are 16.3.6 on the Active LTS line and 15.5.26 on the Maintenance LTS line.

Next.js 15 is not affected by the remote code execution issue. Version 15.5.26 adds related hardening, so Next.js says to update it anyway. The table below shows what to do for each line.

Your version	Affected by the RCE?	What to do
16.3.0 to 16.3.5	Yes, if the other conditions hold	Upgrade to 16.3.6
16.2.x	Yes, if the other conditions hold	Upgrade to 16.3.6, because no patched 16.2 release exists
15.x	No	Update to 15.5.26 for hardening
16.1 or earlier	Not in the affected range	Plan an upgrade to a supported line

The detail about 16.2 matters. According to The Hacker News, no patched release exists on the 16.2 branch, so those teams must move to 16.3.6. Consider whether your lockfile pins 16.2 through a caret range, since a plain npm install will not always cross a minor version on its own.

Does the Edge runtime protect you?

Yes. Applications that use the Edge ImageResponse implementation are not affected, according to the Next.js security bulletin. Only the Node.js implementation carries the flaw, which The Hacker News describes as the default runtime.

ImageResponse is the Next.js class that turns JSX into a PNG image, and it is most often used for social preview images. Satori is the Vercel library underneath it that converts that layout into SVG. The bug lives in that SVG step. Certain values reached the SVG output without proper escaping, per the Satori advisory that Next.js links as related.

Do not treat the Edge runtime as a fix. The advisory does not present it as a mitigation, and moving runtimes to dodge a patch adds risk of its own. Use it as a reason your app may not be exposed today, then patch.

How do you check your project in five minutes?

Run three commands from the project root, because together they establish the installed version, the usage of the vulnerable API, and the runtime that each file selects.

1. Check the installed version:

npm ls next

1. Find every place your code builds an image response:

grep -rn "next/og" app src pages --include="*.ts" --include="*.tsx" --include="*.js" --include="*.jsx"

1. Check whether those files opt into the Edge runtime:

grep -rn "runtime" app src pages --include="*.ts" --include="*.tsx" | grep -i edge

Files that import from next/og and do not declare the Edge runtime will run on Node.js, which is precisely the affected implementation. File conventions such as opengraph-image.tsx and twitter-image.tsx commonly use ImageResponse, so include them in your search. Also check API routes, such as a /api/og endpoint, that many teams built for share cards.

Which inputs make the bug reachable?

The bug is reachable when attacker-controlled values end up inside the generated SVG. The Hacker News reports that the risk applies when values from URLs or requests are inserted into SVG content, attributes, or styles during image generation. That is the third condition, and it is the only one of the three that you can assess just by reading your own application code.

Consider these common patterns, ranked from most to least suspicious:

• A route like /api/og?title=... that prints the query string into the image.
• A dynamic route that renders a URL segment, such as a username, into the image.
• A blog or product page that renders a database field written by users.
• A build-time image that renders only content you wrote yourself.

The first three take input from outside your team. The fourth does not. If your images render only trusted, build-time strings, your practical exposure is low. If you cannot be sure where a value came from, assume it is untrusted and patch.

How do you patch?

Install the fixed version for your line and redeploy. The official patch instructions give these commands:

npm install next@16.3.6
npm install next@15.5.26

Run the first for the 16.3 line and the second for the 15.5 line. Then confirm with npm ls next that only the fixed version is installed. Monorepos sometimes carry a second copy of next in a workspace package, so check every workspace.

According to the Satori advisory, the underlying escaping problem sits upstream, and the Next.js fix upgrades upstream dependencies, including Satori. That means your lockfile will change beyond next itself. Review the diff, run your test suite, and load a page that renders a share image before you ship.

If you cannot upgrade today, The Hacker News lists one temporary measure. Keep untrusted values out of SVG content, attributes, and styles until you can patch. Treat that as a stopgap, since it depends on you finding every input path.

Should you patch now or wait?

Patch now if you run Next.js 16.2.0 or later and use ImageResponse on Node.js with any request-derived input. Vercel's advisory rates the flaw critical, as SecurityOnline's summary repeats, and remote code execution on a server is about the worst outcome a web framework bug can have. As of the latest reporting, The Hacker News says no public exploits or active attacks have been reported. That window tends to close fast once a fix and advisory are public.

Patch this week, without panic, if your images use only trusted content or run on Edge. You are not in the affected path, but you also gain little from waiting.

Our earlier coverage of the Next.js security release that landed August 26 followed the same rhythm. The team publishes an early notice, then ships an out-of-band fix, and the safe habit is to keep a tested upgrade path ready. If your last minor upgrade was painful, our guide to a Turbopack build failing in Next.js 16.3 lists the usual causes to rule out first.