Next.js ImageResponse Bug Forces an Off-Schedule Critical Patch

Next.js shipped an out-of-band security release Sept. 22, patching a critical remote-code-execution bug in the Node.js ImageResponse renderer, two months into a security program built around a predictable monthly calendar (Next.js blog, Sept. 22, 2026).

What changed

The fix lands in next@16.3.6 (Active LTS) and next@15.5.26 (Maintenance LTS, hardening only, since the 15.x line was never exposed to the RCE itself). The bug, tracked as GHSA-vcvr-r3jv-pc5j (CVE-2026-94545), carries a CVSS score of 9.5 and sits in next/og’s Node.js ImageResponse implementation: when an app feeds attacker-controlled values, such as text or an image pulled from the request, into the SVG content, attributes or styles ImageResponse builds, improper escaping in the underlying Satori library chains into code execution on the server. The Edge runtime’s ImageResponse path doesn’t use the affected code and isn’t exposed. Affected versions run 16.2.0 up to 16.3.5.

Netlify published a matching changelog entry the same day, telling customers a site is at risk only if it uses ImageResponse at all and renders untrusted input through it. A static or fully trusted image doesn’t trigger the bug, so most sites using ImageResponse purely for their own fixed og:image are clear (Netlify changelog, Sept. 22, 2026). That’s the same division of labor Firerun has tracked all year: Vercel owns the framework fix, Netlify owns telling its own hosting customers whether they need to move.

Why it matters

This is the third Next.js security release since Vercel formalized a monthly cadence in July, and the first to break it. Firerun covered that program at launch: a pre-announced date and worst-case severity roughly a month out, with emergency, unscheduled patches reserved for anything urgent enough to jump the line (Firerun, July 26, 2026). August’s release, two unauthenticated RCEs bundled into one patch, still landed inside a scheduled window, just a day early (Firerun, Aug. 28, 2026). This one skipped the calendar entirely: Vercel calls it an “out-of-band” fix for “a critical upstream issue,” language that signals urgency rather than routine.

Firerun’s take: a monthly patch calendar is a floor, not a ceiling, and this is that promise being tested, not broken. The exposure here is narrower than August’s: one renderer, one runtime, and only apps that already pipe untrusted input into generated SVG. But a 9.5 CVSS score on anything reachable through request-controlled input isn’t a patch to defer. If next/og shows up anywhere in your app and its output ever includes user-supplied text, treat next@16.3.6 as due today, not next sprint.

Key Takeaways

• Next.js shipped an out-of-band patch Sept. 22, 2026, fixing a critical (CVSS 9.5) remote-code-execution bug in the Node.js ImageResponse renderer, tracked as GHSA-vcvr-r3jv-pc5j / CVE-2026-94545.
• Versions 16.2.0 through 16.3.5 are affected; the fix ships in next@16.3.6. The 15.x line gets a hardening-only release, 15.5.26, and was never exposed to the RCE.
• The bug triggers only when an app renders attacker-controlled input, such as request text or a fetched image, into SVG through ImageResponse’s Node.js runtime; the Edge runtime path is unaffected.
• Netlify posted a same-day changelog scoping which of its customers are exposed, continuing the pattern of fast-following Next.js security releases with its own customer notice.