Input validation error in Next.js - CVE-2026-94545
Published: September 23, 2026
Vulnerability identifier: #VU151855
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-94545
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to an upstream vulnerability in the Node.js ImageResponse implementation from next/og when generating images from SVG content, attributes, or styles containing attacker-controlled values. A remote attacker can supply crafted values for SVG content, attributes, or styles to execute arbitrary code.
Applications using the Edge ImageResponse implementation are not affected.
Affected software
Next.js
How to mitigate CVE-2026-94545
Install security update from vendor's website.
Next.js - update to 16.3.6