Next.js 16.3.6 closes a critical remote code execution hole in next/og
The out-of-band release is available as 16.3.6 on Active LTS and 15.5.26 on Maintenance LTS. Versions from 16.2.0 up to but not including 16.3.6 are affected through the Node.js ImageResponse implementation in next/og, where improper escaping in Satori's SVG output can lead to remote code execution. Applications on the Edge implementation are not affected, and Next.js 15.x does not carry the remote code execution issue at all. The fix works by upgrading the upstream dependencies, Satori among them.
Source
Next.js Security Update for a Critical Upstream IssueNext.js Blog · Original published September 22, 2026
Next.js shipped an out-of-band security release on September 22, 2026, and the advisory is short enough to act on in a minute. If your application is on any version from 16.2.0 up to 16.3.6, and it generates images through the Node.js implementation of ImageResponse in next/og, it is exposed to remote code execution. The patched releases are 16.3.6 for the Active LTS line and 15.5.26 for Maintenance LTS.
Where the hole is
The flaw is not in Next.js code that anyone wrote by hand. ImageResponse renders social images by building SVG through Satori, and under specific conditions that SVG output was escaped improperly. Combined with vulnerabilities in other upstream dependencies, the bad escaping can lead to remote code execution. The fix upgrades those dependencies rather than rewriting the feature.
Two boundaries narrow the blast radius, and both are worth checking before anyone panics. Applications using the Edge implementation of ImageResponse are not affected, because the affected path is the Node.js one. Next.js 15.x does not carry the remote code execution issue either; 15.5.26 exists to add related hardening, not to close this hole.
- Affected: Next.js versions greater than or equal to 16.2.0 and lower than 16.3.6.
- Advisory for Next.js: GHSA-vcvr-r3jv-pc5j.
- Upstream advisory for Satori: GHSA-wx4j-mvgx-mqwp.
- Not affected: the Edge implementation of ImageResponse, and Next.js 15.x.
What to run
Installing next@16.3.6 on the 16.3 line, or next@15.5.26 on 15.5, is the whole remedy. Because the fix lives in transitive dependencies, a lockfile that pins those packages deserves a second look after the upgrade: the Next.js version alone does not prove that the patched Satori actually landed in your tree.
The advisory is signed by Josh Story, Karim Rahal, and Sebastian Silbermann, and Vercel routes this class of report through its Open Source Bug Bounty. That is the second Next.js security event on the same day, after the team announced earlier that an out-of-band release was coming. This post is the one that carries the version numbers.
„Please patch your Next.js dependencies to maintain the security of your applications.“
Related
Python 3.15 makes UTF-8 the default encoding and adds explicit lazy imports
Python 3.15.0 came out on October 9, 2026. Files opened without an explicit encoding are now read and written as UTF-8 on every system, and a new lazy import statement defers loading a module until it is used. The release also adds frozendict and a sampling profiler.
Python Software Foundationverified
Deno's team joins Cloudflare, and the Deno runtime gets one more year of updates
Ryan Dahl announced on October 9, 2026 that the whole Deno team is moving to Cloudflare. The Deno runtime will get monthly fixes for one more year before development ends, and Deno Deploy will shut down after six months. JSR keeps running.
Denoverified
Anthropic's OSS Scanner sends open-source maintainers free vulnerability reports that no human has reviewed
Anthropic launched OSS Scanner on October 8, 2026, an opt-in service that scans eligible open-source projects with its strongest models, including Claude Mythos, at no cost. Each report includes a reproducer, an explanation, and a candidate patch when one exists, but no person checks it before it is sent. Anthropic says it expects more than 90% of findings to be real.
Anthropicverified