TL;DR – update Next.js to 16.3.6.
If you are on Next.js 15 or use the Edge ImageResponse implementation, you are not affected by this vulnerability.
Checkmarx SCA already supports detection of this vulnerability, it’s in our database, and scans will automatically flag applications running the affected versions, so customers using Checkmarx don’t need to hunt for this manual; the exposure surfaces directly in their scan results.
Introduction
Recently, we dubbed CVE-2026-75604 as React2Shell2. A new critical Remote Code Execution (RCE) vulnerability was discovered (CVE-2026-94545) that affects Next.js.
This time, the issue affects ImageResponse, a feature that converts JSX and CSS into PNG images. During image generation, if malicious code is injected into SVG content, attributes, or styles in the JSX passed to ImageResponse, it can be executed by Next.js.
- Next.js – Patched Versions:
16.3.6
- Next.js – Affected Versions:
16.2.0 through 16.3.5
What is Happening
Next.js released two new versions yesterday, upgrading upstream dependencies: 15.5.26 and 16.3.6.
Next.js updated its Satori dependency, a library that converts JSX and CSS to SVG. The update fixed an Improper Escaping of SVG Elements vulnerability in Satori, where insufficient escaping allowed attacker-controlled values in SVG elements, XML names, and internal style fields to be interpreted as SVG markup.
The fix commit hardens SVG serialization, indicating the prior version didn’t adequately sanitize input before generating SVG markup.
The fix now escapes text and attribute values before inserting them into SVG markup, preventing supplied values from creating additional elements or attributes.
How does this affect Next.js
CVE-2026-94545 was disclosed as a vulnerability in Next.js ImageResponse, but the underlying issue resides in Satori’s SVG processing.
ImageResponse generates PNG images from JSX and CSS. Internally, it uses Satori to convert the JSX and CSS into SVG, which is then used to generate the final PNG image.
The vulnerability occurs when attacker-controlled values, masked as SVG markup, are passed to SVG elements in the JSX provided to ImageResponse. Because Satori’s SVG processing doesn’t sanitize these values properly, they end up incorporated into the SVG Satori generates.
To produce the final PNG image, ImageResponse then processes the generated SVG. Because the malicious SVG markup has already been injected into the generated SVG, it executes during this process, resulting in exploitation.
Mitigation
This vulnerability only affects users of Next.js 16.2.0 or higher. Update to Next.js 16.3.6.
Users of Next.js 15 or the Edge implementation of ImageResponse are not affected by this vulnerability.
Conclusions
This vulnerability highlights an important principle: developers should continue to enforce proper input validation and sanitization, even when relying on popular frameworks such as Next.js, React, Spring, and others.
Delegating security controls entirely to upstream components that are expected to provide both complete functionality and adequate security can create a false sense of safety. Large, widely adopted frameworks often provide extensive security mechanisms and follow secure-by-design principles, but they are not inherently immune to vulnerabilities.
In recent years, we have continued to see security issues emerge in even the most widely used frameworks and libraries. This reinforces the importance of treating framework-level security controls as an additional layer of defense rather than a substitute for application-level validation and input controls.
Vulnerabilities