A brand new safety vulnerability in Subsequent.js may permit attackers to run code on a server by way of ImageResponse, the characteristic that generates Open Graph and different social preview pictures, Vercel mentioned.
The chance applies when an app places values an attacker controls, akin to textual content learn from the request URL, into the picture. Vercel, which develops Subsequent.js, mounted the flaw on September 22 in model 16.3.6.
The flaw, tracked as CVE-2026-94545, impacts Subsequent.js 16.2.0 by 16.3.5 when ImageResponse runs on the Node.js runtime, which Subsequent.js makes use of by default. Vercel’s advisory charges it vital, with a CVSS rating of 9.5. The Edge model of ImageResponse just isn’t affected, and neither is Subsequent.js 15.
ImageResponse makes use of Satori, a Vercel library, to transform the picture structure into SVG code earlier than the ultimate PNG is generated. Affected apps are people who “go attacker-controlled values into SVG content material, attributes, or kinds throughout picture era”, in response to the advisory.
The advisory’s instance takes a worth from the request URL and locations it inside an SVG title ingredient. It doesn’t say whether or not textual content in extraordinary components, akin to a heading inside a div, additionally counts.
To seek out the place an app makes use of the characteristic, search for ImageResponse imported from subsequent/og, for instance in route handlers and in opengraph-image recordsdata. Route handlers make the picture when a request arrives. An opengraph-image file could make it at construct time or when a request arrives.
As of September 23, The Hacker Information discovered no public studies of assaults utilizing the flaw and no public exploit code.
The repair is Subsequent.js 16.3.6, the one patched model, put in with npm set up subsequent@16.3.6. As of September 23, the npm registry listed no mounted launch for the 16.2 line, so apps on 16.2 want to maneuver to 16.3.6. Subsequent.js 15.5.26 provides additional safety hardening for subsequent/og on the 15.5 line.
If upgrading has to attend, the advisory’s workaround is to maintain attacker-controlled values out of the SVG content material, attributes, and kinds that the Node.js ImageResponse renders. The advisory doesn’t recommend switching to the unaffected Edge model, and the Subsequent.js documentation marks the Edge runtime as deprecated.
In checks by The Hacker Information on September 23, npm audit didn’t flag Subsequent.js 16.3.5, an affected model. The advisory was additionally not but listed within the GitHub Advisory Database, and no CVE file for CVE-2026-94545 had been revealed.
Test the Subsequent.js model instantly. Satori is bundled contained in the Subsequent.js package deal, so a lockfile doesn’t checklist it as a dependency of Subsequent.js.
Vercel’s advisory and announcement don’t say whether or not apps hosted on Vercel are protected. For two vital Subsequent.js flaws mounted in August, the corporate mentioned hosted apps had been protected and wanted no improve.
Vercel’s advisory and announcement additionally present no approach to examine whether or not an affected route was abused earlier than the patch. Affected variations have been out there since Subsequent.js 16.2 was launched on March 18.
The bug itself is in Satori. Satori’s personal advisory, revealed the identical day, says sure values reached its SVG output with out being correctly escaped. A specifically made worth may then be learn as SVG code as an alternative of plain textual content.
In Subsequent.js, such values may attain vulnerabilities in different libraries that Subsequent.js is dependent upon and result in code execution, Vercel mentioned. It has not named these libraries.
Satori’s advisory charges the identical CVE as average, with a rating of 5.3, and says the impression is dependent upon how the SVG output is used. Builders who use Satori instantly ought to replace it to model 0.33.5, which has the repair.
