What happened
Unauthenticated RCE in Next.js next/og via SVG injection to native libraries.
Affected versions
Unknown product: See original advisory Fixed: See vendor advisory.
Why it matters
This source correlation may provide earlier visibility while structured CVE metadata is still being updated.
Detection & mitigation
- Review the original advisory and validate affected versions.
- Apply vendor-provided updates or mitigations when available.
Public PoC references
RepositoryAuthorFirst seenReference
Sploituscandidate2026-09-23T07:04:40VerifiedHassham1/CVE-2026-94545-nextjs-og-pocCVE-2026-94545 / GHSA-vcvr-r3jv-pc5j — Next.js next/og ImageResponse SVG injection (Satori, GHSA-wx4j-mvgx-mqwp): isolated Docker validation lab with vulnerable (16.3.5) vs patched (16.3.6) controls, non-destructive Python scanner with pixel-level PNG evidence, and root-cause analysis of the upstream Satori fix. Authorized security research only.★ 1Hassham12026-09-23VerifiedHORKimhab/CVE-2026-94545CVE-2026-94545 - Draft or TODO★ 1HORKimhab2026-09-23VerifiedSploitusUnauthenticated RCE in Next.js next/og via SVG injection to native libraries.EQSTLab2026-09-29T07:58:11VerifiedEQSTLab/CVE-2026-94545Unauthenticated RCE in Next.js next/og via SVG injection to native libraries.EQSTLab2026-09-29T07:58:11VerifiedSploitusProof-of-concept exploit for CVE-2026-94545.Sploitus index2026-09-30T05:52:57+00:00Candidatemhtsec/CVE-2026-94545Next.js `next/og` allows unauthorized remote code execution via Satori SVG processing.mhtsec2026-09-30T05:53:08VerifiedSploitusUnauthenticated RCE or DoS in Next.js /_next/image via librsvg use-after-free.lion94532026-10-16T06:31:41Verifiedlion9453/CVE-2026-96889-nextjs-rceUnauthenticated RCE or DoS in Next.js /_next/image via librsvg use-after-free.lion94532026-10-16T06:31:41VerifiedSource timeline
Discovered through SploitusView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.