# Next.js Ships an Emergency RCE Fix, Then Nine More Bugs Loom

Page: https://hirantha.me/blog/nextjs-ships-an-emergency-rce-fix-then-nine-more-bugs-loom
Published: 2026-09-25
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: nextjs, vercel, remote code execution, web security, javascript frameworks

> A critical flaw in Next.js image generation allowed remote code execution, and a second patch covering nine more bugs is due September 30.

## Two security releases in eight days

Vercel pushed an out-of-band security update for Next.js on September 22, shipping versions 16.3.6 and 15.5.26 to close a critical remote code execution (RCE) hole. A day later, the project gave advance notice of a second, already-scheduled release for September 30, which will land as 16.3.7 and 15.5.27 and fix nine more vulnerabilities: one critical, two high, five medium, and one low. Teams running Next.js, the widely used React framework built by Vercel, have two separate patch cycles to track inside a single week and a half.

## What the September 22 flaw actually does

The emergency fix addresses CVE-2026-94545, rated 9.5 out of 10 on the CVSS v4 severity scale. It sits in `next/og`, the Next.js module that generates images on the fly, through a feature called `ImageResponse`. That feature takes JSX and CSS a developer writes and hands it to a library called Satori, which converts the markup into SVG (Scalable Vector Graphics) image data. The bug is in how that conversion handles values that come from outside the developer's own code, such as user input rendered into a dynamically generated social-media card image. Satori did not properly escape those values before writing them into the SVG output, and because SVG can carry active content, improperly escaped input could end up executed rather than simply displayed. Combined with separate flaws in other upstream dependencies, that gave an attacker a path to run arbitrary code on the server.

The practical exposure is narrower than "every Next.js site." It only affects the Node.js runtime implementation of `ImageResponse` in versions 16.2.0 up to but not including 16.3.6; the Edge runtime implementation is unaffected, and Next.js 15.x does not carry the RCE at all, though Vercel shipped 15.5.26 anyway with related hardening. Any site that calls `ImageResponse` with data that ultimately traces back to a user, a query parameter, or any other outside source is the scenario to check first.

## The fix

```bash
# Next.js 16.3 branch
npm install next@16.3.6

# Next.js 15.5 branch (hardening only, not vulnerable to the RCE)
npm install next@15.5.26
```

Projects that call the Satori library directly, outside of Next.js's own wrapper, need to upgrade it separately to version 0.33.5, which carries the corresponding fix on the upstream side.

This is not a novel category of bug. Server-side image and document generation features across many frameworks have repeatedly turned into RCE paths over the years, because they sit at the intersection of two things that are individually safe but dangerous combined: markup that can embed active content, like SVG or HTML, and input that ultimately comes from outside the application. A field that looks like plain text to a developer, such as a product name or a username used to personalize a generated card, can carry SVG or script syntax an image renderer does not expect.

## What's coming September 30

Vercel's advance notice for the second release does not yet name the nine vulnerabilities it will fix, only their severity breakdown: one critical, two high, five medium, one low. The company says it will publish full advisories, including affected versions and upgrade instructions, alongside the 16.3.7 and 15.5.27 release itself. Until those advisories land, there's no way to know whether any of the nine reuse the same `ImageResponse` code path or sit somewhere else in the framework entirely.

## What it means for developers

Anyone running Next.js in production should treat the September 22 update as done, not optional, particularly if the app uses `ImageResponse` for anything touching user-supplied data such as dynamic Open Graph images, generated certificates, or personalized social cards. Beyond that immediate patch, the more useful move is to block out time around September 30 to review Vercel's advisories the day they publish, rather than assuming the emergency fix already covered whatever comes next. Both releases are being coordinated through Vercel's public bug bounty program on HackerOne, so the underlying reports and fixes are traceable back to named researchers once the advisories go live.

A reasonable interim check, ahead of either advisory, is a quick audit of every place `ImageResponse` appears in a codebase: note which ones accept anything from a URL parameter, form field, or database record that ultimately originated with a user, and confirm each one is running on a patched version before September 30 arrives with a fresh batch of fixes to evaluate.

## Questions

**Do I need to update Next.js right now?**
Yes, if your app is on 16.2.0 through 16.3.5 and uses the Node.js ImageResponse feature in next/og, you should update to 16.3.6 immediately since the flaw allows remote code execution.

**Is Next.js 15 affected by the remote code execution bug?**
No, Next.js 15.x is not affected by the CVE-2026-94545 remote code execution issue, though 15.5.26 includes related hardening and is still worth installing.

**What is next/og and ImageResponse?**
They are a Next.js feature for generating images, such as social-media preview cards, on the fly from JSX and CSS by converting them to SVG through a library called Satori.

**What's in the September 30 Next.js release?**
Vercel has said it will fix nine vulnerabilities, one critical, two high, five medium, and one low, but has not yet published which specific issues they are; full advisories are due alongside the release.

**Does the Edge runtime version of ImageResponse have this bug?**
No, Vercel says only the Node.js runtime implementation of ImageResponse is affected by CVE-2026-94545.

## Sources

- [Next.js Security Update for a Critical Upstream Issue](https://nextjs.org/blog/nextjs-security-update-september-22-2026), Next.js Blog
- [Upcoming Next.js September Security Release](https://nextjs.org/blog/upcoming-nextjs-security-release-september-2026), Next.js Blog
- [CVE-2026-94545 - From JSX to SVG Injection](https://checkmarx.com/zero-post/cve-2026-94545-from-jsx-to-svg-injection/), Checkmarx
- [Critical Next.js RCE Vulnerability CVE-2026-94545 Fixed](https://securityonline.info/nextjs-rce-vulnerability-cve-2026-94545/), SecurityOnline