Next.js CVE-2026-94545: The ImageResponse RCE Every Headless Commerce Team Must Patch

On September 22, 2026, the Next.js team shipped a security release for CVE-2026-94545, tracked upstream as GHSA-vcvr-r3jv-pc5j. The flaw sits in the next/og ImageResponse API, the tool most Next.js commerce storefronts use to generate dynamic Open Graph images for product pages, category pages, and social share cards on the fly. A crafted SVG passed into that rendering path can trigger server side code execution, and it does not require an authenticated session to trigger. The Hacker News ran the story the same day under the headline "Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input," and both Vercel and Netlify published their own changelog notes walking hosted customers through the fix.

What ImageResponse actually does, and why that matters here

ImageResponse is the API behind next/og: you hand it JSX, it renders that JSX to an image at request time, and the result gets served as a dynamically generated Open Graph card. Headless commerce teams lean on it constantly, product pages need a fresh share image per SKU, category pages need seasonal variants, and hand building a static image for every combination is not realistic at catalog scale. That popularity is exactly what makes CVE-2026-94545 worth treating as urgent rather than routine. Any route that touches ImageResponse, directly or through a library that wraps it, is a route that renders attacker supplied input on your server if that input reaches the SVG rendering path.

The upgrade path

Why this is the fourth release since May, not the first

Next.js shipped security releases in May, July, and August of 2026 before this one, which makes September's CVE-2026-94545 patch the fourth in five months, a pace that is unusual for a framework this central to production commerce infrastructure. None of those releases individually is catastrophic on its own, but the pattern is the part worth internalizing: a framework carrying this much surface area, image rendering, edge middleware, server actions, streaming responses, produces a steady cadence of upstream dependency issues, and a team that treats each one as an isolated one off patch rather than a signal to tighten its own upgrade cadence will eventually get caught between releases with a known, public CVE sitting in production.

How this compares to the August release

The August 2026 Next.js security release addressed two separate unauthenticated RCE paths, one through AVIF image handling and one through a Windows specific issue in path resolution. CVE-2026-94545 is a different vulnerability in a different code path, the next/og ImageResponse renderer rather than the general image optimization pipeline, but the shared thread across both releases is instructive: both live in code that renders untrusted or partially trusted input into a binary output format, image bytes in the August case, an image rendered from JSX and SVG in this one. A team that patched August's release and considered image handling closed for the year is exactly the team most likely to assume this release is redundant with work already done, when it is a distinct fix addressing a distinct rendering path.

What to actually check this week

Start with your package-lock.json or pnpm-lock.yaml, not your package.json. A direct dependency bump to next@16.3.6 does not guarantee every internal package or vendored component also resolved to the patched version, and CVE-2026-94545 is exactly the kind of flaw that hides behind a stale transitive pin nobody remembers adding. Next, grep your codebase for every ImageResponse import and trace what data reaches its JSX tree; the exposure is proportional to how much of that input a customer, not your own content team, controls. Finally, if you are on Vercel or Netlify, read their platform specific changelog notes rather than assuming the framework patch alone covers platform level mitigations they may have layered on top.

When this applies to your stack

If your storefront is built on Next.js commerce, whether that is a custom build, Shopify Hydrogen's Next.js flavored patterns, or a headless frontend serving dynamic product imagery, this is not a background maintenance item. An unauthenticated, server side code execution path in a widely used image API is the kind of finding that turns into an incident the moment a scanner or a bad actor notices it is unpatched, and the fix here is a version bump plus an audit, not a rewrite.

Contra Collective builds and maintains Next.js based headless commerce storefronts for enterprise clients, including the dependency audit and upgrade discipline that catches issues like this before they become incidents rather than after. If you are not confident your team's lockfile actually resolved to 16.3.6 across every service that touches ImageResponse, that is worth a direct check today rather than at your next scheduled dependency review.

FAQ

Does CVE-2026-94545 require an authenticated attacker? No. The vulnerability is exploitable without authentication, which is what makes it a critical severity finding rather than a lower priority one; any public facing route that reaches the ImageResponse rendering path is exposed regardless of login state.

Is upgrading to Next.js 16.3.6 sufficient on its own? The version upgrade addresses the core vulnerability, but teams should also audit which routes pass user controlled input into ImageResponse and confirm cached OG images generated before the patch are invalidated, since a stale cache can continue serving output tied to the vulnerable rendering path.

How is this different from the August 2026 Next.js security release? The August release addressed separate AVIF and Windows path issues enabling unauthenticated RCE through a different mechanism. CVE-2026-94545 is a distinct flaw in the next/og ImageResponse API specifically, triggered through crafted SVG input, not the image optimization pipeline the August release covered.

What if we do not use next/og directly? Check whether any third party component, theme, or internal shared package wraps ImageResponse on your behalf. Indirect usage through a dependency is common enough in commerce codebases that a direct grep for next/og imports across your own code is not sufficient on its own; check your dependency tree too.