Next.js Framework 16.2.x / 16.3.x < 16.3.6 RCE

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362680);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id("CVE-2026-94545");
  script_xref(name:"IAVA", value:"2026-A-1079");

  script_name(english:"Next.js Framework 16.2.x / 16.3.x < 16.3.6 RCE");

  script_set_attribute(attribute:"synopsis", value:
"The Next.js Framework on the remote host is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Next.js Framework on the remote host is affected by a remote code execution vulnerability:

  - The Node.js ImageResponse implementation from next/og is affected by an upstream Satori vulnerability.
    Satori does not properly escape certain values before including them in generated SVG output, which can
    allow crafted values to be interpreted as SVG markup. Applications that pass attacker-controlled values
    into SVG content, attributes, or styles during image generation can be led to remote code execution.
    (CVE-2026-94545)

Exploitation additionally requires that the application uses the Node.js ImageResponse implementation from
next/og and passes attacker-controlled values into SVG content, attributes, or styles. Applications using the
Edge ImageResponse implementation are not affected. Nessus cannot verify how the application invokes
ImageResponse, so this finding is reported as a potential vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b408c079");
  # https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9e5d1ebc");
  script_set_attribute(attribute:"see_also", value:"https://github.com/vercel/next.js/releases/tag/v16.3.6");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Next.js Framework version 16.3.6 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-94545");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vercel:next.js");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

# handle canary builds, e.g. 16.3.0-canary.60
vcf::add_separator('-');
vcf::add_conversions({'canary':-25});

var app_info = vcf_extras::nodejs_modules::get_app_info(app:'next');

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, 'next');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  {'min_version':'16.2.0', 'fixed_version':'16.3.6'}
];

# The advisory scopes the flaw to applications that pass attacker-controlled values into SVG content rendered by
# the Node.js ImageResponse implementation from next/og, which cannot be verified remotely, so the finding is
# flagged as requiring configuration.
vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE,
  missing_config_check:true
);