https://reddit.com/r/cybersecurity/comments/1wtxh6x/cve202694545_cvss_95_affects_nextjs_apps_using/: CVE-2026-94545 (CVSS 9.5) affects Next.js apps using next/og on the Node.js runtime with sharp.

Q: Which deployments are exposed to this issue?

Deployments using Next.js 16.2.0 through 16.3.5 are affected when they use next/og on the Node.js runtime with sharp. Edge runtime deployments and setups without sharp are reportedly not affected.

Q: What level of access does an attacker need?

A vulnerable OG image endpoint could allow an unauthenticated attacker to achieve remote code execution. No prior authentication is described as necessary.

Q: What versions address the issue?

Update Next.js to 16.3.6. The reported fixed Satori version is 0.33.5.

Published Sep 30, 2026

Updated

Affected Software

1 affected component

Vercel Next.js>=16.2.0<=16.3.5

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Next.js 16.2.0 through 16.3.5 are affected when they use next/og on the Node.js runtime with sharp. Edge runtime deployments and setups without sharp are reportedly not affected.

What level of access does an attacker need?

A vulnerable OG image endpoint could allow an unauthenticated attacker to achieve remote code execution. No prior authentication is described as necessary.

What versions address the issue?

Update Next.js to 16.3.6. The reported fixed Satori version is 0.33.5.