Two security releases in eight days
Vercel pushed an out-of-band security update for Next.js on September 22, shipping versions 16.3.6 and 15.5.26 to close a critical remote code execution (RCE) hole. A day later, the project gave advance notice of a second, already-scheduled release for September 30, which will land as 16.3.7 and 15.5.27 and fix nine more vulnerabilities: one critical, two high, five medium, and one low. Teams running Next.js, the widely used React framework built by Vercel, have two separate patch cycles to track inside a single week and a half.
What the September 22 flaw actually does
The emergency fix addresses CVE-2026-94545, rated 9.5 out of 10 on the CVSS v4 severity scale. It sits in next/og, the Next.js module that generates images on the fly, through a feature called ImageResponse. That feature takes JSX and CSS a developer writes and hands it to a library called Satori, which converts the markup into SVG (Scalable Vector Graphics) image data. The bug is in how that conversion handles values that come from outside the developer's own code, such as user input rendered into a dynamically generated social-media card image. Satori did not properly escape those values before writing them into the SVG output, and because SVG can carry active content, improperly escaped input could end up executed rather than simply displayed. Combined with separate flaws in other upstream dependencies, that gave an attacker a path to run arbitrary code on the server.
The practical exposure is narrower than "every Next.js site." It only affects the Node.js runtime implementation of ImageResponse in versions 16.2.0 up to but not including 16.3.6; the Edge runtime implementation is unaffected, and Next.js 15.x does not carry the RCE at all, though Vercel shipped 15.5.26 anyway with related hardening. Any site that calls ImageResponse with data that ultimately traces back to a user, a query parameter, or any other outside source is the scenario to check first.
The fix
# Next.js 16.3 branch
npm install [email protected]
# Next.js 15.5 branch (hardening only, not vulnerable to the RCE)
npm install [email protected]
Projects that call the Satori library directly, outside of Next.js's own wrapper, need to upgrade it separately to version 0.33.5, which carries the corresponding fix on the upstream side.
This is not a novel category of bug. Server-side image and document generation features across many frameworks have repeatedly turned into RCE paths over the years, because they sit at the intersection of two things that are individually safe but dangerous combined: markup that can embed active content, like SVG or HTML, and input that ultimately comes from outside the application. A field that looks like plain text to a developer, such as a product name or a username used to personalize a generated card, can carry SVG or script syntax an image renderer does not expect.
What's coming September 30
Vercel's advance notice for the second release does not yet name the nine vulnerabilities it will fix, only their severity breakdown: one critical, two high, five medium, one low. The company says it will publish full advisories, including affected versions and upgrade instructions, alongside the 16.3.7 and 15.5.27 release itself. Until those advisories land, there's no way to know whether any of the nine reuse the same ImageResponse code path or sit somewhere else in the framework entirely.
What it means for developers
Anyone running Next.js in production should treat the September 22 update as done, not optional, particularly if the app uses ImageResponse for anything touching user-supplied data such as dynamic Open Graph images, generated certificates, or personalized social cards. Beyond that immediate patch, the more useful move is to block out time around September 30 to review Vercel's advisories the day they publish, rather than assuming the emergency fix already covered whatever comes next. Both releases are being coordinated through Vercel's public bug bounty program on HackerOne, so the underlying reports and fixes are traceable back to named researchers once the advisories go live.
A reasonable interim check, ahead of either advisory, is a quick audit of every place ImageResponse appears in a codebase: note which ones accept anything from a URL parameter, form field, or database record that ultimately originated with a user, and confirm each one is running on a patched version before September 30 arrives with a fresh batch of fixes to evaluate.
