We recently found a new RCE chain affecting the Node.js ImageResponse implementation in Next.js. Vercel has published CVE-2026-94545. Next.js versions from 16.2.0 through 16.3.5 are affected. Upgrade to Next.js 16.3.6. I'll share more details soon, once the remaining upstream advisories are out! Credit also to RagRocks, who discovered this... together with me Post:show more

presente professor

Is there no public PoC available for this yet?

Not yet, probably next week

Hi, great finding! Btw, is there a way to keep the app running even after RCE is achieved?

If the app is using multiple workers/replicas probably, here since I used just a simple process it ends up crashing inevitably

I see, thanks for the insight

Nice find, the Node-only part is the interesting bit. Different rasterizer on that path or same lib with a different sandbox?

Different rasterizers. Edge uses Resvg/WASM, while the Node path uses a different lib

What makes this wild is how the unescaped user input inside Satori's SVG parser gets passed straight down to underlying native bindings like resvg-js to pull off the full RCE.