Talk to an expert
ProductsSolutionsTrustPricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Critical Next.js Flaw Lets Attackers Trigger RCE Through Weaponized SVG Images

A critical, unauthenticated vulnerability in Next.js (CVE-2026-94545) lets attackers achieve remote code execution by smuggling malicious input into server-side SVG image generation. Here's what's affected and how to fix it.

4T4Tify Team4Tify
Sep 23, 2026·5 min read
Critical Next.js Flaw Lets Attackers Trigger RCE Through Weaponized SVG Images

A newly disclosed vulnerability in Next.js, tracked as CVE-2026-94545, allows attackers to achieve remote code execution on servers that generate images dynamically — with no authentication and no user interaction required.

What happened

The flaw lives in the Node.js implementation of Next.js's ImageResponse feature, most commonly used to generate Open Graph preview images through next/og routes. When an application takes a value from a URL parameter, form field, or API request and embeds it directly into an SVG — for example inside a <title> element — an attacker can craft input that reaches the SVG rendering process and executes arbitrary code on the server.

The issue has been assigned a Critical severity rating under CVSS v4. It can be triggered remotely over the network, requires no authentication, and needs no interaction from a victim — a combination that makes it especially attractive to automated scanning and exploitation.

Not every deployment is exposed. Applications running the Edge implementation of ImageResponse are not affected. On Node.js, only applications that pass attacker-controlled values into SVG content, attributes, or CSS styles are vulnerable — if user input never reaches the SVG markup, the feature is safe to use as-is.

Why it matters

Because the vulnerable code path handles image generation, it often runs with access to whatever the hosting environment exposes to that process — which can include secrets, cloud credentials, internal services, or deployment infrastructure. A successful exploit could let an attacker read sensitive server-side data, tamper with generated content, disrupt the service, or use the compromised process as a foothold to move further into the environment. The actual blast radius depends heavily on how the application is hosted and what the image-generation process can reach.

Internet-facing Open Graph image endpoints are also easy to find and probe automatically, which raises the likelihood of opportunistic exploitation once the flaw becomes widely known.

What to do

  • Patch first. Upgrade affected Next.js installations to version 16.3.6, where the issue is fixed.
  • Audit next/og routes. Review every endpoint that generates images through ImageResponse, especially Open Graph routes that read query-string parameters, and identify any untrusted value that ends up inside SVG markup.
  • If you can't patch immediately, stop passing user-controlled input into SVG content, attributes, or styles processed by the Node.js ImageResponse implementation.
  • Don't rely on input validation alone. SVG parsing and rendering behavior is complex enough to create unexpected bypass paths, so treat validation as a stopgap, not a permanent fix.

Teams running internet-facing Next.js applications with dynamic image generation should treat this as a priority patch.

SHARE