Security Update: Critical Next.js vulnerability in ImageResponse
September 22, 2026
The Next.js team has disclosed a critical severity vulnerability in an upstream dependency that can lead to remote code execution when ImageResponse renders untrusted input. It is patched in 15.5.26 and 16.3.6. Applications that do not pass untrusted input into ImageResponse are not expected to be affected. Here’s what Netlify customers need to know.
Vulnerabilities
- GHSA-vcvr-r3jv-pc5j / CVE-2026-94545 — Remote Code Execution in
next/ogImageResponse. Critical. Patched in 15.5.26 and 16.3.6.
Impact on Netlify
Netlify sites are affected only if they use ImageResponse and the image it generates includes untrusted input — text, or an image loaded from the request. Sites that don’t use ImageResponse, or that only render trusted content through it, are not affected.
For sites that do, the impact is limited to a crashed function invocation, not code execution. On Netlify, this has minimal impact: our autoscaling serverless architecture means that a malicious request resulting in a crashed function does not affect other requests. However, active exploitation could increase your function costs.
What should I do?
We strongly recommend upgrading as soon as possible to patched releases:
next15.5.26 or later, or 16.3.6 or later, then redeploy.
Until you can upgrade, do not place untrusted input inside elements passed to ImageResponse. Escape it as XML before rendering, or keep it out of the generated image entirely.
Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted. Consider deleting these deploys manually.