🚨 CRITICAL NEXT.JS RCE DISCLOSED — ATTACKER-CONTROLLED SVG DATA CAN LEAD TO SERVER CODE EXECUTION Vercel has disclosed a critical remote-code-execution vulnerability affecting the Node.js implementation of ImageResponse in Next.js. • CVE-2026-94545 / GHSA-vcvr-r3jv-pc5j • CVSS 9.5 Critical • Affects Next.js >=16.2.0 and <16.3.6 • Exploitation is network-accessible and requires no authentication or user interaction, but requires an affected application configuration • Applications are vulnerable when attacker-controlled values reach SVG content, attributes or styles rendered through next/og ImageResponse • Successful exploitation can lead to remote code execution on the Node.js server • The Edge implementation of ImageResponse is NOT affected • Applications that never place attacker-controlled data into generated SVG content, attributes or styles are also not affected • Fixed in Next.js 16.3.6 • Vercel recommends removing untrusted SVG input from Node.js ImageResponse as a workaround where immediate upgrading is impossible • No confirmed in-the-wild exploitation has been identified at this time ⚠️ Analyst Note: The interesting attack surface is dynamic image generation. Open Graph/social-preview images often incorporate URL parameters, usernames, titles or other externally supplied content — exactly the type of data that can become attacker-controlled. Internet-facing Next.js applications using server-side ImageResponse should therefore review not only their framework version but whether untrusted values flow into SVG generation. Original Vercel / Next.js security advisory: github.com/vercel/next.js/se… #NextJS #Vercel #CVE202694545 #RCE #WebSecurity #Vulnerability #ThreatIntel #DDW #DarkWeb