SecurityThe Hacker Newsabout 3 hours ago
Critical Next.js ImageResponse Flaw Allows Server Code Execution
3 min read
Vercel patched a critical Next.js flaw on September 22 in version 16.3.6. CVE-2026-94545, rated 9.5, lets attackers run server code through ImageResponse when attacker-controlled values reach SVG output on the Node.js runtime. Versions 16.2.0 through 16.3.5 are affected; Next.js 15 and the Edge runtime are not. No public exploits reported as of September 23.
Level
Hype check
Tap to vote and see what everyone thinks.
