Public proof-of-concept material for CVE-2026-94545 has appeared, but the available reports do not establish that the flaw can be exploited on every Next.js deployment. The critical vulnerability affects the Node.js ImageResponse implementation from next/og when attacker-controlled values reach SVG content, attributes, or styles. Next.js first fixed the affected 16.x line in 16.3.6; its September 30 security release subsequently recommended 16.3.8 for Active LTS and 15.5.27 for Maintenance LTS. Teams should check their runtime, data flow, and resolved dependencies, then upgrade to the applicable current release.
What the CVE-2026-94545 PoC reports actually show
There are public GitHub repositories discussing the flaw, but their claims differ. The Hassham1 validation lab says it demonstrated SVG markup injection and patched behavior, while explicitly stating that it did not demonstrate remote code execution. The mhtsec repository advertises an unauthenticated RCE proof of concept. Those are claims by the repository authors, not independent validation across arbitrary deployments; the official advisories confirm the vulnerability, not the repositories’ exploit results.
As an Amazon Associate I earn from qualifying purchases.
Accordingly, the accurate summary is that public PoC material has appeared, including one repository advertising RCE, while another says its demonstration stopped at SVG injection. The existence of these repositories does not by itself show that a particular site is vulnerable or that it has been exploited.
What the vulnerability affects
The Next.js advisory describes an upstream SVG-escaping vulnerability that can lead to remote code execution through the Node.js ImageResponse implementation from next/og. Its example involves taking a query-string value and inserting it into an SVG <title> rendered by ImageResponse. The security issue is therefore about a specific rendering path and data flow, not simply the presence of Next.js on a server.
#1 Best Overall
- Fortinet Web Application Firewall - virtual appliance for all supported platforms. Supports up to 2 x vCPU core
- Fortinet HW FWB-VM02
- Manufacturer Part: FWB-VM02
The upstream Satori security advisory describes certain values not being properly escaped before inclusion in generated SVG. Those values can be interpreted as SVG markup; the advisory says downstream impact depends on how the generated SVG is consumed. Next.js rates its framework-level advisory CVSS 9.5, Critical, while Satori rates its library-level advisory CVSS 5.3, Moderate. The scores describe advisories with different scopes and should not be treated as competing ratings of an identical issue.
Which versions and configurations are affected?
| Component or configuration | What the advisories say |
|---|---|
| Next.js version | >=16.2.0 <16.3.6 is the affected range in the Next.js security advisory. |
| Next.js rendering path | Node.js ImageResponse from next/og is in scope when attacker-controlled values are passed into SVG content, attributes, or styles. Edge ImageResponse is excluded by the advisory. |
| Applications without the specified data flow | The vendor says applications that do not pass attacker-controlled values into the relevant SVG contexts are not affected. |
| Next.js 15.x | Vercel says the RCE does not affect 15.x. Version 15.5.26 included related hardening, rather than a CVE-specific RCE fix for that branch. |
| Satori | Versions >=0.0.27 <0.33.5 are affected by the upstream improper-escaping issue; Satori 0.33.5 is patched. |
These conditions mean that a version check alone may not settle exposure. A deployment also needs the relevant implementation and attacker-controlled input reaching the vulnerable SVG output path. Conversely, a team should not infer safety solely from a route’s name or from the fact that an application generates social-image metadata; inspect the actual code and deployed dependency tree.
Rank #2
- Fortinet Web Application Firewall - virtual appliance for all supported platforms. Supports up to 4 x vCPU core
- Fortinet HW FWB-VM04
- Manufacturer Part: FWB-VM04
How to check an application’s exposure
- Identify deployed versions. Check the resolved Next.js and Satori versions in the dependency tree used by the deployed application, not only the version range written in a package manifest.
- Find image-generation code. Search the application for imports or use of
next/ogand Satori, then locate the routes or functions that generate images. - Trace input into SVG output. Determine whether query parameters, form values, user content, or other attacker-controlled data reaches SVG text, attributes, or styles passed to Node.js
ImageResponseor affected Satori code. - Confirm the runtime. Establish whether the relevant
ImageResponseruns on Node.js or Edge. The Next.js advisory excludes EdgeImageResponsefrom this issue. - Choose the relevant upgrade target. Follow the applicable Next.js branch release guidance and update direct Satori consumers to a patched release.
These checks identify the conditions the vendors describe; the final exposure assessment depends on the application’s code, runtime, and deployed dependency versions.
Free tools Windows power users keep installed
One-click scans. No signup required.
Which version fixes it, and what should teams upgrade to?
For the CVE-specific issue, Next.js 16.3.6 was the first fixed release on the affected 16.x line. The September 22 Next.js security update also released 15.5.26 as related hardening and stated that 15.x was not affected by this RCE. On September 30, Next.js published a further security release recommending 16.3.8 for Active LTS and 15.5.27 for Maintenance LTS. Those later versions are branch security targets that address additional security issues; they are distinct from the first CVE-specific fix. Confirm the currently supported release for your branch before upgrading.
Rank #3
- Fortinet Web Application Firewall - virtual appliance for all supported platforms. Supports up to 8 x vCPU core
- Fortinet HW FWB-VM08
- Manufacturer Part: FWB-VM08
Organizations using Satori directly should upgrade to version 0.33.5 or later. The Satori advisory says no complete workaround exists besides upgrading; while an upgrade is pending, it advises against rendering attacker-controlled content with affected Satori versions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do while an upgrade is pending
The Next.js advisory says not to pass attacker-controlled values into SVG content, attributes, or styles processed by the vulnerable Node.js ImageResponse implementation. For affected Satori versions, the upstream advisory likewise advises against rendering attacker-controlled content. Treat these as temporary risk-reduction steps, not substitutes for upgrading: the advisories do not establish WAF filtering, authentication, or another generic mitigation as a complete fix.
Rank #4
- Meraki MX100: A building block for SASE in a rack-mountable form factor. Medium- to large-branch security and SD-WAN appliance for up to 500 users.
- WAN: 1 x GbE RJ45, 1 x USB (cellular failover), Dual-purpose: 1 x GbE RJ45 +++ LAN: 8 x GbE RJ45, 2 x GbE SFP
- Stateful firewall throughput: 750 Mbps +++ 500 Mbps site-to-site VPN throughput
- Unified management for security, SD-WAN, Wi-Fi, switching, MDM, and IoT +++ Centralized management via web-based dashboard or API
- True zero-touch provisioning +++ Smartphone-like firmware updates
No affected-host count or confirmed exploitation total is established in the cited official materials. Netlify’s customer notice says impact for affected Netlify sites is limited to a crashed function invocation; that platform-specific statement should not be generalized to self-hosted or other deployments.
Quick Recap
Best Value
- ◆Powerful Celeron N2840 Processor: N2840 Processor, 2 Cores 2 Threads, 1M Cache, Max Turbo Frequency 2.58 GHz, TDP 7.5 W. Whether you need a robust home server, a versatile tool for school education, seamless web browsing, or even efficient business office or industrial tasks, providing efficient performance for everyday tasks.
- ◆Dual 1000M LAN: Mini Router PC with 2*Realtek RTL8111H network card chip full UDE 1000M with filter connector.Soft Router can monitor network data, improve network security, powerful and widely used.
- ◆DDR3L Memory & Large Storage Capacity: Firewall box computer with 1 x DDR3L SO-DIMM memory 1333/1600MHz, 1xMSATA3.0 SSD.
- ◆UHD Graphics & 4K Dual Screen Display: N2840 processor integrated UHD Graphics, HD and VGA dual display interfaces support 4K@60Hz.
- ◆Versatile Connections ports: 2 x1000M Realtek RTL8111H-LAN,2 xUSB3.0, 4 xUSB2.0, HDMI,VGA,AUDIO supports data storage and system boot.Mini desktop computer with WIFI dual antenna, which providing high-speed transmission and reliable connectivity. Support Dual Band Wifi, Internet, streaming media and audio can be used perfectly without interrupting the connection. Enjoy faster file transfers and smoother online experiences.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
