Next.js next/og Unauthenticated RCE (CVE-2026-94545) Security Advisory
CVE-2026-94545 is an unauthenticated remote code execution flaw in Next.js next/og, scored CVSS 3.1 9.8, affecting Next.js 16.2.0 through versions before 16.3.5 when Node.js and sharp are in use. Operators should upgrade Next.js to 16.3.6 or later and Satori to 0.33.5 or later.
Vulnerability overview
Name: Unauthorized remote code execution in Next.js next/og
Identifiers: QVD-2026-75497, CVE-2026-94545
Disclosed: 2026-09-23
Scale of exposure: on the order of 100,000 assets
Qi An Xin rating: high
CVSS 3.1: 9.8
Threat type: code execution
Likelihood of use: high
In-the-wild use: not observed
Harm: An unauthenticated attacker can run commands with the privileges of the Next.js server process. Impact includes reading environment variables and application secrets, reaching internal services, placing persistent backdoors, and moving laterally. Confidentiality, integrity, and availability are all affected. Successful use is blind and can replace a worker process, causing a temporary outage.
Component
Next.js is a React full-stack framework from Vercel used for corporate sites, commerce, and content platforms. The built-in next/og module generates Open Graph images on the server. JSX is rendered to SVG by Satori and then rasterized to PNG by sharp. The module typically runs in the Node.js runtime. OG image routes are often reachable without authentication.
Description
Qi An Xin CERT reports that Vercel patched an unauthenticated remote code execution issue in Next.js next/og (CVE-2026-94545). The issue comes from an output-encoding defect in Satori (CWE-116). When an OG image route runs on the Node.js runtime with sharp installed, unsafe input can reach native image libraries (libvips, librsvg, libxml2), cause memory corruption, and yield remote code execution.
Deployments that use the edge runtime, or that do not install sharp, are not affected for code execution. No authentication and no user interaction are required on a vulnerable Node.js plus sharp deployment. Qi An Xin advises operators to inventory and patch promptly given the number of exposed assets.
Affected versions
- Next.js 16.2.0 inclusive through versions below 16.3.5, when running on the Node.js runtime with sharp installed
- Satori 0.0.27 inclusive through versions below 0.33.5
Other affected component: Satori, the JSX-to-SVG renderer used by next/og.
Advisory image
Exposed assets
Qi An Xin Hawk Map asset mapping lists 385,701 at-risk assets in China and 107,338 related IP addresses. Distribution:
Globally, the same mapping lists 2,772,161 at-risk assets and 1,021,066 related IP addresses. Distribution:
Remediation
Apply vendor patches:
- Upgrade Next.js to 16.3.6 or later
- Upgrade Satori to 0.33.5 or later (this release escapes SVG text during serialization)
Downloads: https://github.com/vercel/next.js/releases
Temporary mitigations:
1. Switch next/og routes to export const runtime = "edge" so rendering uses sandboxed resvg-wasm. 2. Remove the sharp dependency so the native image-parsing path is not used. 3. Do not pass unsanitized user input into ImageResponse child nodes. 4. Add authentication or an access allowlist on OG image routes.
References
[1] https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j