Next.js 16.3.6

On September 22, 2026, Vercel published Next.js 16.3.6 as an out-of-band release to address a critical security vulnerability disclosed in the next/og ImageResponse API.

Vulnerability Detail

The issue, tracked as CVE-2026-94545, is a remote code execution flaw in next/og. The ImageResponse utility relies on Satori, a Vercel library that converts an image layout into SVG before rasterizing the final PNG. A crafted SVG payload could be exploited to execute arbitrary code on the server, making it a critical-severity and remotely reachable vector for applications that render dynamic social images or open-graph previews.

Affected Versions and Resolution

All Next.js applications on the 16.2 and 16.3 lines are affected. Next.js 16.3.6 contains the fix and is the upgrade target for affected deployments. The team also shipped Next.js 15.5.26 to patch the 15.x line. Teams are strongly advised to update promptly and to review any use of ImageResponse with unsanitized SVG content.

Recommended Action

Upgrade to Next.js 16.3.6 (or 15.5.26 on the 15.x line) immediately. Where ImageResponse is used, treat SVG input as untrusted until the application has been verified. This release addresses the disclosed critical issue and is available for install through the npm registry without additional configuration.