Security Update: Critical Next.js vulnerability in ImageResponse
By Steven Van ·
Netlify says affected sites see a crashed function, not code execution, but recommends upgrading to Next.js 15.5.26 or 16.3.6 right away.
The Next.js team has disclosed a critical vulnerability, CVE-2026-94545 (GHSA-vcvr-r3jv-pc5j), in the next/og ImageResponse API that can lead to remote code execution when ImageResponse renders untrusted input, such as text or an image loaded from the request. It's patched in Next.js 15.5.26 and 16.3.6. Sites that don't use ImageResponse, or that only render trusted content through it, aren't affected.
In its security update, Netlify notes that for affected sites on its platform, the impact is limited to a crashed function invocation rather than code execution: its autoscaling serverless architecture means a malicious request that crashes a function doesn't affect other requests. Active exploitation could still increase function costs.
- Upgrade to next 15.5.26 or later, or 16.3.6 or later, then redeploy.
- Until upgraded, keep untrusted input out of elements passed to ImageResponse, or escape it as XML first.
- Delete public deploy previews and branch deploys manually, since they may remain vulnerable until they're automatically deleted.