On September 22, 2026, Vercel shipped an out-of-band security release for Next.js: v16.3.6 on the Active LTS line and v15.5.26 on Maintenance LTS (Next.js blog). It patches a critical-severity, unauthenticated remote code execution vulnerability in the Node.js implementation of ImageResponse, the API next/og uses to generate social share images on the fly. Less than 24 hours later, Vercel gave advance notice of a second, larger release scheduled for September 30 that will fix nine more vulnerabilities across the framework (Next.js blog). If your team ships on Next.js, both dates belong on the calendar.
What next/og actually does
next/og's ImageResponse is the API behind those dynamically generated Open Graph images you see when a link gets shared on social media or Slack — a post title, author name, or product price rendered onto a 1200×630 card without anyone hand-designing it. Under the hood, it takes JSX-like markup, converts it to SVG with a library called Satori, and rasterizes the result to a PNG. It's a genuinely useful piece of the framework, and because it's designed to render dynamic, often user- or CMS-supplied text, it sits directly on a trust boundary: whatever a visitor, a form submission, or a query string contributes to a page title is exactly the kind of value that ends up inside the generated image.
That's what made this bug worth an out-of-band release instead of waiting for the normal monthly cycle.
The root cause: an escaping bug in Satori
The underlying issue is tracked as GHSA-wx4j-mvgx-mqwp against Satori itself, rated moderate (CVSS 5.3) in isolation: Satori doesn't properly escape certain values before writing them into the SVG markup it generates, which lets specially crafted input break out of the intended text context and inject arbitrary SVG elements or attributes. On its own, that's an SVG injection problem. Chained through the rest of the Node ImageResponse rendering pipeline in affected Next.js versions, Vercel's advisory (GHSA-vcvr-r3jv-pc5j) escalates it to critical-severity remote code execution — the kind of bug that doesn't require authentication and can be triggered by anyone who can reach the affected route.
The pattern most teams actually ship looks something like this, and it's exactly the shape that's exposed:
// app/og/route.tsx
import { ImageResponse } from 'next/og'
export async function GET(request: Request) {
const { searchParams } = new URL(request.url)
const title = searchParams.get('title') ?? 'Untitled'
return new ImageResponse(
(
<div style={{ fontSize: 64, background: '#fff', padding: 60 }}>
{title}
</div>
),
{ width: 1200, height: 630 }
)
}
There's nothing careless about this code — it's the standard example pattern for dynamic OG images, and title coming straight from a query string or a database field is normal. The vulnerability lived in how Satori handled that string on its way into SVG, not in any obvious mistake at the application layer.
Who's affected
Next.js versions >=16.2.0 <16.3.6 are affected by the RCE. The 15.x line was not vulnerable to the remote code execution issue itself; v15.5.26 ships related hardening only. Vercel's advisory also draws a clear line on runtime: applications using the Edge runtime implementation of ImageResponse are not affected — only the Node.js implementation is in scope. If your next/og routes don't explicitly opt into the Edge runtime, assume you're on the Node path and act accordingly.
Patching
The fix is a dependency bump, not a code change on your side:
npm install [email protected] # Active LTS
# or
npm install [email protected] # Maintenance LTS — hardening only, RCE did not apply to 15.x
Upgrading pulls in the corrected Satori version and closes the escaping issue at its source. There's no configuration flag or workaround that substitutes for the upgrade — GitHub's advisory for Satori is blunt about it: applications that can't upgrade immediately shouldn't render attacker-controlled content with the library at all.
A bigger release is scheduled for September 30
A day after the out-of-band patch, Vercel published advance notice of a separate, previously scheduled security release for September 30, 2026, covering nine vulnerabilities: one critical, two high, five medium, and one low. It will ship as v16.3.7 and v15.5.27, with full advisories — impact, affected versions, upgrade instructions — published alongside the release. Vercel didn't publish details of the individual issues ahead of time, which is standard practice to avoid giving attackers a head start before patches are available. What is public is the severity mix, and one more critical-severity issue in the same week as an RCE is reason enough to plan for it now rather than reactively.
Practically, that means treating September 30 the same way you'd treat any release with a known critical fix in it: know who owns the upgrade, have your CI and deploy pipeline ready to ship a patch release the same day, and don't let it queue behind unrelated work.
Hardening beyond the patch
Patching closes this specific hole, but the incident is a useful prompt to look at image-generation routes more broadly, whether they use next/og or something built on Satori directly — the library is used outside Next.js too, in various screenshot and theming tools, and the same underlying escaping fix matters anywhere it's a dependency.
A few things worth doing regardless of patch status: treat any value that reaches an ImageResponse or similar SVG-generating renderer as untrusted input, the same way you'd treat a value headed into dangerouslySetInnerHTML — validate length and character set rather than interpolating raw strings. Check whether OG-image or card-generation routes are reachable anonymously and at volume; adding basic rate limiting reduces the blast radius of both this class of bug and unrelated abuse (scraping, cost exhaustion) at the same time. And if your team doesn't already have a way to hear about Next.js advisories quickly — watching the Next.js blog or subscribing to GitHub security advisories for next and its key dependencies — this is a good week to set that up, given a second release is already on the calendar.
Takeaways
Upgrade to [email protected] (or 15.5.26 for hardening) today if you use next/og's Node runtime ImageResponse anywhere in your app — check for it even in routes you didn't write yourself, since starter templates and CMS integrations often include one. Confirm which runtime your OG routes actually use; don't assume Edge just because it's an option. Then block out September 30 for a second patch cycle: nine vulnerabilities, including one more critical, are landing in 16.3.7 and 15.5.27, with no public detail yet on what they cover. Dynamic image generation is a convenient feature, but it's also a rendering pipeline that touches untrusted input by design — worth treating with the same scrutiny as any other user-input surface.