CVE-2026-94545-nextjs-og-poc

CVE-2026-94545 - Next.js next/og ImageResponse SVG Injection GHSA-vcvr-r3jv-pc5j Security-research material for reproducing and validating CVE-2026-94545 , the Next.js ImageResponse SVG-serialization injection upstream: Satori GHSA-wx4j-mvgx-mqwp, in an isolated, loopback-only lab. Affected:...

Next.js Framework 16.2.x / 16.3.x < 16.3.6 RCE

The Next.js Framework on the remote host is affected by a remote code execution vulnerability: - The Node.js ImageResponse implementation from next/og is affected by an upstream Satori vulnerability. Satori does not properly escape certain values before including them in generated SVG output, whi...

GHSA-VCVR-R3JV-PC5J Next.js: Remote Code Execution in next/og ImageResponse

Impact The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: tsx import ImageResponse from...

NPM: Next.js: Remote Code Execution in next/og ImageResponse

NPM: Next.js: Remote Code Execution in next/og ImageResponse vulnerability discovered by ? in WordPress Npm next versions = 16.2.0, 16.3.6...

Next.js: Remote Code Execution in next/og ImageResponse

Impact The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: tsx import ImageResponse from...

PT-2026-105541

Impact The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: tsx import ImageResponse from...

The vulnerability of the ImageResponse component in the next/og software platform for creating web applications allows a attacker to execute arbitrary code.

The vulnerability of the ImageResponse component in the next/og software platform for creating web applications in Next.js is related to improper encoding or escaping of output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Exploit for CVE-2026-94545

CVE-2026-94545 - Next.js next/og ImageResponse SVG Injection...

Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input

A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said. The risk applies when an app puts values an attacker controls, such as text read from the request URL, into...

PT-2026-97045

Name of the Vulnerable Software and Affected Versions Next.js versions 16.2.0 through 16.3.5 Description A flaw in the Node.js implementation of the ImageResponse component within the next/og package occurs due to improper encoding or escaping of output data. This issue arises when...