Skip to content
Threat Feed
Subscribe

Product

Next.js (16.2.0-16.3.5)

1 brief RSS
critical advisory

Critical RCE Vulnerability in Next.js ImageResponse via Crafted SVG Input

A critical vulnerability (CVE-2026-94545) in the Next.js ImageResponse feature allows unauthenticated remote code execution when attacker-controlled input is improperly sanitized during SVG generation.

Next.js +1 web-vulnerability rce server-side nextjs
1t