Security Update: Critical Next.js vulnerability in ImageResponse

Netlify · Tuesday at 1:44 PM

The Next.js team has disclosed a critical severity vulnerability in an upstream dependency that can lead to remote code execution when ImageResponse renders untrusted input. It is patched in 15.5.26 and 16.3.6. Applications that do not pass untrusted input into ImageResponse are not expected to be affected. Here’s what Netlify customers need to know. Vulnerabilities

GHSA-vcvr-r3jv-pc5j / CVE-2026-94545 — Remote Code Execution in next/og ImageResponse. Critical. Patched in 15.5.26 and 16.3.6.

Impact on Netlify Netlify sites are affected only if they use ImageResponse and the image it generates includes untrusted input — text, or an image loaded from the request. Sites that don’t use ImageResponse, or that only render trusted content through it, are not affected. For sites that do, the impact is limited to a crashed function invocation, not code execution. On Netlify, this has minimal impact: our autoscaling serverless architecture means that a malicious request resulting in a crashed function does not affect other requests. However, active exploitation could increase your function costs. What should I do? We strongly recommend upgrading as soon as possible to patched releases:

next 15.5.26 or later, or 16.3.6 or later, then redeploy.

Until you can upgrade, do not place untrusted input inside elements passed to ImageResponse. Escape it as XML before rendering, or keep it out of the generated image entirely. Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted. Consider deleting these deploys manually. Resources

Next.js security advisory (GHSA-vcvr-r3jv-pc5j)
Next.js Security Update for a Critical Upstream Issue
Next.js security advisories