Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Next.js ImageResponse SVG code execution security flaw (CVE-2026-94545)

Vulnerability
First reported
Last updated
Happening score
H score 31
1 unique sources, 1 articles

Summary

Hide ▲

CVE-2026-94545 affects Next.js ImageResponse on the Node.js runtime, where attacker-controlled SVG input can lead to server-side code execution. The flaw impacts Next.js 16.2.0 through 16.3.5 and was fixed in 16.3.6. Next.js 15 and the Edge version of ImageResponse are not affected. No public attack reports or public exploit code were known as of September 23.

Timeline

  1. 23.09.2026 10:04 1 articles · 1h ago

    Vercel releases Next.js 16.3.6 to fix CVE-2026-94545

    Mitigation Patch Update

    Vercel fixed CVE-2026-94545 in Next.js 16.3.6 on September 22. The patch addresses the ImageResponse flaw affecting Next.js 16.2.0 through 16.3.5 on the Node.js runtime; the Edge version of ImageResponse and Next.js 15 are not affected.

    Show sources
    Open in new tab
  2. 23.09.2026 10:04 2 articles · 1h ago

    Vercel warns that crafted SVG input can trigger server code execution in Next.js ImageResponse

    Initial Disclosure

    Vercel said Next.js ImageResponse on the Node.js runtime can allow attackers to run code on a server when attacker-controlled values are inserted into SVG content, attributes, or styles during image generation. The flaw is tracked as CVE-2026-94545, affects Next.js 16.2.0 through 16.3.5, carries a CVSS score of 9.5, and no public reports of attacks or public exploit code were known as of September 23.

    Show sources
    Open in new tab