Critical Next.js CVE-2024-XXXXX RCE Flaw Lets Attackers Use SVG Files

Key Takeaways

• A critical remote code execution (RCE) vulnerability (CVE-2026-94545) has been identified in Next.js versions 16.2.0 through 16.3.5.
• The flaw impacts the Node.js ImageResponse implementation within the next/og package, specifically when processing malicious SVG content.
• Attackers can exploit this by injecting crafted SVG data into applications that use untrusted input for image generation.
• The vulnerability carries a Critical CVSS v4 severity rating, allowing unauthenticated, remote exploitation.
• A patch is available in Next.js version 16.3.6, and immediate upgrades are strongly recommended.

A severe vulnerability has been uncovered in Next.js, designated as CVE-2026-94545, which could enable remote code execution (RCE) on affected systems. This critical flaw resides within the Node.js ImageResponse implementation, part of the next/og package, and can be triggered through specially crafted SVG (Scalable Vector Graphics) content during the image generation process.

The issue impacts Next.js applications ranging from versions 16.2.0 up to, but not including, 16.3.6. Developers are urged to prioritize upgrading their installations to Next.js 16.3.6, which incorporates the necessary security fix.

Understanding the Vulnerability

The core of this vulnerability lies in the Node.js ImageResponse feature, a component commonly used for the dynamic creation of Open Graph images, social media previews, and other graphics generated server-side. The underlying image-rendering engine contains a security flaw that can be activated when an application incorporates attacker-controlled data into SVG elements, attributes, or styles.

Attackers can exploit this weakness when a vulnerable application accepts input from untrusted sources—such as URL parameters, form fields, or API requests—and subsequently embeds this untrusted value directly into an SVG image. For instance, an application might retrieve a parameter from an incoming request and then render it within an SVG <title> element while generating an image via ImageResponse.

Remote Code Execution Potential

In scenarios where a Next.js application is deployed with this vulnerable configuration, a malicious actor could submit specially crafted SVG-related input that ultimately reaches the susceptible rendering process. Successful exploitation of this vulnerability could lead to remote code execution on the server responsible for handling the image-generation request.

The GitHub advisory (GHSA-vcvr-r3jv-pc5j) assigns this vulnerability a Critical severity rating under CVSS v4. The attack vector is remote over the network, requires no authentication, and can be executed without any user interaction.

Despite the low prerequisites for an attack, the potential consequences are severe. Successful exploitation could compromise the confidentiality, integrity, and availability of both the vulnerable system and any connected systems. A compromised Next.js image-generation environment might expose sensitive server-side data, allow unauthorized modification of hosted content, disrupt services, or provide attackers with an initial foothold for broader network intrusions.

The actual impact would largely depend on the specific hosting environment of the Next.js application, its assigned permissions, and whether the image-generation process has access to sensitive data such as secrets, cloud credentials, internal services, or deployment infrastructure.

Affected Systems and Mitigation

It is important to note that not all Next.js deployments are vulnerable. According to the advisory, applications utilizing the Edge implementation of ImageResponse are not affected. Furthermore, applications that use the Node.js ImageResponse feature but consistently avoid placing attacker-controlled values into SVG content, attributes, or CSS styles are also not at risk.

The vulnerability was reported by security researchers RaghavMaheshwari124 and rafabd1. The advisory explicitly identifies the affected package as next, with version 16.3.6 designated as the patched release.

What You Should Do

• Upgrade Immediately: Update all affected Next.js applications to version 16.3.6 or newer. This is the most effective and recommended mitigation.
• Review Endpoints: Conduct an immediate review of all endpoints that generate images using next/og, paying particular attention to Open Graph image routes that accept query-string parameters or other user-controlled input.
• Isolate Untrusted Input: Identify and eliminate any instances where untrusted values are rendered directly inside SVG markup, attributes, or CSS styles processed by the Node.js ImageResponse implementation.
• Avoid Input Validation as Sole Fix: While input validation is a good practice, it should not be considered a complete or permanent solution for this vulnerability due to the complexities of SVG parsing and rendering, which can introduce unforeseen attack vectors.
• Prioritize Patching: Given that internet-facing image-generation endpoints are often easily discoverable and probe-able by attackers, treat this vulnerability as a high-priority patching requirement.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.