Next.js next/og ImageResponse Remote Code Execution — CVE-2026-94545

CVE-2026-94545 is a critical (CVSS v4 9.5) remote code execution vulnerability in the Node.js runtime implementation of ImageResponse, the next/og feature Next.js applications use to generate Open Graph and social-preview images. The vulnerable path runs through Satori, Vercel's JSX/HTML-to-SVG conversion library: when an application places attacker-controlled input (a query-string value, header, or other request-derived data) into SVG content, attributes, or styles during image generation, improperly escaped output can be interpreted as active SVG markup and reach vulnerabilities in downstream rendering dependencies, ultimately yielding code execution in the context of the Node.js application process.

Affected versions are Next.js 16.2.0 through 16.3.5 when ImageResponse runs on the Node.js runtime (the default runtime). The Edge runtime implementation of ImageResponse is not affected, and Next.js 15.x is not affected by the RCE (15.5.26 ships related defense-in-depth hardening only). Vercel fixed the issue in Next.js 16.3.6, released 2026-09-22. The underlying flaw is tracked upstream in Satori itself (GHSA-wx4j-mvgx-mqwp, fixed in Satori 0.33.5) and is bundled inside the Next.js package rather than listed as an independent dependency, so a lockfile audit alone will not surface it.

As of the cited reporting dates (2026-09-23/24), no public proof-of-concept and no confirmed in-the-wild exploitation had been reported. That means this pack is built almost entirely around behavioral detection and version/configuration facts rather than atomic network or file indicators — there is no published campaign infrastructure to block. The highest-value defensive angle is not the exploit trigger itself (an HTTP request to an image-generation route, which Falcon endpoint telemetry cannot see) but what a successful exploit does afterward on the Node.js application server: spawning a shell or interpreter, reaching out to the network, writing new files into the web root, or reading credential material — all of which the Falcon sensor already instruments on any host where it is deployed.

Web-hunter decisions

• No source published atomic network/file IOCs (C2 domains, IPs, hashes) — consistent with "disclosed, patched, not yet exploited in the wild." The pack does not invent any; see Section 10.
• All five secondary sources agree on the version range, fix version, and Node-vs-Edge distinction; this pack treats those facts as high confidence.
• Source-injection check: every fetched page was reviewed for text addressed to an AI assistant, requests to fetch further URLs, claims of administrator/user authority, or instructions to skip validation steps. None was found in any of the six saved snapshots. SOC Prime's page contained ordinary commercial calls-to-action for its own platform ("Prime Detect", "Uncoder AI", "Contact Sales") and securityonline.info carried an unrelated ad sidebar for two other CVEs — both are normal marketing/site furniture directed at a human reader, not a prompt-injection attempt, and neither was acted on. Full verbatim snapshots are saved alongside this file in NextJS-ImageResponse-CVE-2026-94545-Hunt-sources/ for provenance.

Hunt hypotheses

1. (High conf) A Node.js application process (parent) spawns a shell, script interpreter, or discovery/recon binary it would not normally spawn — the highest-fidelity signal that server-side code execution in the Node process was used to shell out. MITRE T1190 / T1059.
2. (High conf) That same Node.js process spawns a network tool-transfer utility (curl, wget, certutil, bitsadmin) to stage a second-stage payload. MITRE T1105.
3. (Medium conf) The Node.js process itself opens an unusual outbound network connection (reverse shell, staging, or C2 check-in) to a destination port outside the application's normal service ports. MITRE T1071 / T1571.
4. (Medium conf) The Node.js process (or a spawned child) writes a new executable or script into the web root, build-output, or cache directories — a dropped web shell or persistence payload. MITRE T1505.003 / T1105.
5. (Medium conf) The Node.js process reads credential-shaped files (.env, SSH keys, cloud credential files, .npmrc tokens) shortly after code execution, consistent with an attacker harvesting secrets reachable by the app's service account. MITRE T1552.001.
6. (Medium conf, exposure hunt, not an attack signal) Fleet-wide identification of hosts actually running a Next.js production server process, to prioritize patch/audit effort — command-line evidence only; EDR telemetry cannot confirm the exact installed next package version, only that a Next.js server process is running.

Attack chain

No atomic network or file indicators (domains, IPs, hashes) have been published for CVE-2026-94545 as of the cited sources — there is no confirmed in-the-wild exploitation and no public PoC to derive them from. This table therefore ships version/configuration facts, which are the real, sourced "indicators" available for this vulnerability, plus behavioral signals. No entry here is a fabricated atomic IOC.

These checks do not depend on the Falcon sensor and cover the parts of the attack chain (recon and the exploit trigger itself) that endpoint telemetry cannot see.

1 · Reverse-proxy / access-log grep for the exploit trigger

Search web-server or edge-proxy access logs for requests to known OG-image routes carrying HTML/SVG-shaped or URL-encoded payloads:

grep -EI "GET /(api/og|opengraph-image|twitter-image|og-image)[^ ]*(%3C|%3E|<|>|javascript:|data:)" /var/log/REPLACE_WITH_ACCESS_LOG_PATH

2 · Application code audit for the vulnerable pattern

Find every call site and manually confirm none interpolates request-derived data into SVG content, attributes, or styles:

grep -rn "from 'next/og'" --include=*.ts --include=*.tsx --include=*.js --include=*.jsx .
grep -rn "ImageResponse(" --include=*.ts --include=*.tsx --include=*.js --include=*.jsx .
# then manually inspect each match: does searchParams / headers / body / any
# request-derived value reach the returned SVG's content, attributes, or styles?

3 · Runtime version audit (fleet-wide)

npm ls next --depth=0
node -e "console.log(require('./node_modules/next/package.json').version)"
npm view next version   # compare installed vs. latest to confirm 16.3.6+ or 15.5.26+

4 · Container / Kubernetes image inventory

kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"/"}{.metadata.name}{"\t"}{.spec.containers[*].image}{"\n"}{end}' | grep -i next
docker images --format '{{.Repository}}:{{.Tag}}' | grep -i next

FP note: build agents legitimately run next build/next-server constantly; scope checks 3 and 4 to identify hosts, not to alert, and cross-reference against Section 3's attack chain before treating a hit as suspicious.

All six queries below target Node.js application-server processes via ParentBaseFileName/FileName/ContextBaseFileName matches on node — this schema is identical whether the sensor runs on bare metal, a VM, or inside a container via Falcon Cloud Workload Protection, so no rewrite is needed to cover containerized Next.js hosts. If your tenant tags container/pod identity on these events with additional fields, they are not included below because they are not verified against this pipeline's Falcon data-model reference — ⚠ validate any container/pod identity field names in your tenant before adding them.

// HUNT: Node.js process spawning shell/interpreter/recon binary (CVE-2026-94545 post-exploitation)
// MITRE: T1190, T1059.004, T1059.003, T1059.006
// CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 on Next.js application-tier hosts
// FALSE POSITIVES: npm/yarn/pnpm lifecycle scripts, "next build", pm2 process manager restarts, container health-check wrapper scripts that shell out from a node parent
// TUNING: exclude ParentCommandLine="*npm*install*", ParentCommandLine="*next build*", ParentCommandLine="*pm2*"; scope the search to the production runtime host group and exclude CI/build agents
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^node(\.exe)?$/i
| FileName=/^(sh|bash|dash|zsh|ksh|cmd|powershell|pwsh|python[0-9.]*|perl|ruby|whoami|id|uname|hostname|ifconfig|ip|ipconfig|netstat|ss)(\.exe)?$/i
| table([aid, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, FileName, CommandLine, TargetProcessId, ProcessStartTime])

// HUNT: Node.js process spawning ingress tool-transfer utility (CVE-2026-94545 post-exploitation)
// MITRE: T1105
// CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 on Next.js application-tier hosts
// FALSE POSITIVES: deployment/artifact-fetch agents and container entrypoint scripts that legitimately curl/wget build artifacts at startup
// TUNING: exclude CommandLine="*REPLACE_WITH_INTERNAL_ARTIFACT_REPO_HOST*" for known internal package/artifact repositories; scope to production runtime hosts and exclude deployment/CI agents
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^node(\.exe)?$/i
| FileName=/^(curl|wget|scp|ftp|tftp|certutil|bitsadmin)(\.exe)?$/i
| table([aid, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, FileName, CommandLine, TargetProcessId, ProcessStartTime])

// HUNT: Node.js process outbound connection to non-standard port (CVE-2026-94545 post-exploitation)
// MITRE: T1071, T1571
// CONF: medium  FP: high  COST: medium
// REQUIRES: NetworkConnectIP4 on Next.js application-tier hosts
// FALSE POSITIVES: legitimate outbound calls to databases, caches, message queues, internal microservice APIs, and third-party SaaS integrations on non-web ports
// TUNING: baseline your environment's legitimate outbound service ports first and extend the !in() exclusion list below (databases, queues, internal APIs) before enabling this as anything beyond an audited hunt query
#event_simpleName=/NetworkConnectIP4/
| ContextBaseFileName=/^node(\.exe)?$/i
| !in(field=RemotePort, values=[80, 443, 3000, 5000, 5432, 6379, 8080, 8443, 9092, 27017])
| table([aid, ComputerName, ContextBaseFileName, LocalPort, RemoteAddressIP4, RemotePort, ProcessStartTime])

// HUNT: New executable/script written by Node.js process (CVE-2026-94545 persistence / web shell)
// MITRE: T1505.003, T1105
// CONF: medium  FP: high  COST: low
// REQUIRES: PeFileWritten / NewExecutableWritten / ELFFileWritten / ZipFileWritten on Next.js application-tier hosts
// FALSE POSITIVES: "next build" and CI/CD pipelines write large numbers of files into .next/cache, node_modules, and dist/build output directories as routine behavior
// TUNING: exclude TargetFileName="*/.next/cache/*", TargetFileName="*/node_modules/*"; scope to production runtime hosts only and exclude build/CI agents entirely
#event_simpleName=/PeFileWritten|NewExecutableWritten|ELFFileWritten|ZipFileWritten/
| ContextBaseFileName=/^node(\.exe)?$/i
| table([aid, ComputerName, ContextBaseFileName, TargetFileName, ProcessStartTime])

// HUNT: Node.js process reading credential-shaped files (CVE-2026-94545 post-exploitation credential access)
// MITRE: T1552.001
// CONF: medium  FP: medium  COST: low
// REQUIRES: FileOpenInfo / FileReadInfo on Next.js application-tier hosts
// ⚠ validate in tenant: confirm FileOpenInfo/FileReadInfo populate ContextBaseFileName in your sensor version before relying on this filter
// FALSE POSITIVES: the application legitimately reads its own .env at process startup; CI/build agents read .npmrc during "npm install" on nearly every build
// TUNING: baseline normal startup-time .env reads for this app and exclude them by time-window or by known ProcessStartTime proximity; exclude build/CI hosts entirely for the .npmrc pattern
#event_simpleName=/FileOpenInfo|FileReadInfo/
| ContextBaseFileName=/^node(\.exe)?$/i
| TargetFileName=/(\.env(\.[a-z]+)?$|id_rsa$|credentials$|\.pem$|\.npmrc$)/i
| table([aid, ComputerName, ContextBaseFileName, TargetFileName, ProcessStartTime])

// HUNT: Fleet inventory of hosts running a Next.js server process (exposure hunt, not an attack signal)
// MITRE: N/A — exposure/inventory hunt, not an attacker TTP
// CONF: medium  FP: low  COST: medium
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 fleet-wide
// FALSE POSITIVES: none expected (this is inventory, not a suspicious-behavior hunt) — it will legitimately match every host that runs Next.js, patched or not
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^node(\.exe)?$/i
| CommandLine="*next-server*" OR CommandLine="*next/dist/bin/next*" OR CommandLine="*node_modules/.bin/next*"
| groupBy([ComputerName, aid], function=[count(as=Hits), collect([CommandLine], limit=1)], limit=20000)
| table([ComputerName, aid, Hits, CommandLine])

No atomic network or file indicators exist for this CVE at the time this pack was built. The CSV block below intentionally ships REPLACE_WITH_… placeholders only — do not populate it with guessed values. The remaining blocks carry the real, sourced version/configuration facts and behavioral signatures instead.

type,value,action,severity,expiration,description,tags
sha256,REPLACE_WITH_SHA256_IF_A_PAYLOAD_IS_RECOVERED,detect,high,2027-03-26,CVE-2026-94545 post-exploitation payload (no public sample as of pack build date),campaign:NextJS-ImageResponse-CVE-2026-94545
domain,REPLACE_WITH_C2_DOMAIN_IF_OBSERVED,detect,high,2027-03-26,CVE-2026-94545 post-exploitation C2 (no published campaign infrastructure as of pack build date),campaign:NextJS-ImageResponse-CVE-2026-94545
ipv4,REPLACE_WITH_C2_IP_IF_OBSERVED,detect,high,2027-03-26,CVE-2026-94545 post-exploitation C2 (no published campaign infrastructure as of pack build date),campaign:NextJS-ImageResponse-CVE-2026-94545

# Behavioral signatures for CVE-2026-94545 post-exploitation (see Section 8 for full CQL)
ParentBaseFileName == node(.exe)  AND  FileName in {sh,bash,cmd,powershell,python*,whoami,id,uname,...}
ParentBaseFileName == node(.exe)  AND  FileName in {curl,wget,certutil,bitsadmin,...}
ContextBaseFileName == node(.exe) AND  NetworkConnectIP4 to RemotePort not in {80,443,3000,5000,5432,6379,8080,8443,9092,27017}
ContextBaseFileName == node(.exe) AND  new PE/ELF/script/archive written outside .next/cache or node_modules
ContextBaseFileName == node(.exe) AND  TargetFileName matches *.env, id_rsa, credentials, *.pem, .npmrc

component,affected_range,patched_version,source
next (npm),16.2.0 through 16.3.5,16.3.6,GHSA-vcvr-r3jv-pc5j
satori (npm, bundled inside next),0.0.27 through 0.33.4,0.33.5,GHSA-wx4j-mvgx-mqwp
next (npm) 15.x line,not RCE-affected,15.5.26 (hardening only),nextjs.org security blog 2026-09-22

npm ls next --depth=0
npm view next version
grep -rn "from 'next/og'" --include=*.ts --include=*.tsx --include=*.js --include=*.jsx .
grep -rn "ImageResponse(" --include=*.ts --include=*.tsx --include=*.js --include=*.jsx .

Playbook A — Patch Next.js to the fixed release

Prerequisites: a maintenance window or blue/green deploy path; CI able to rebuild the application image. Reboot required: no (application redeploy required, not an OS reboot). Rollback: keep the pre-upgrade build artifact/image tagged; redeploy it if the new release regresses application behavior.

1. Confirm current version:
   npm ls next --depth=0

2. Bump the dependency (16.x line):
   npm install next@16.3.6
   # or, for the 15.x hardening-only line:
   npm install next@15.5.26

3. Rebuild and redeploy the application image/container — do not
   hot-patch node_modules on a running host; Satori is bundled
   inside next, so only a full reinstall/rebuild updates it.

4. Verify the RUNNING process, not just the manifest:
   node -e "console.log(require('./node_modules/next/package.json').version)"

5. Re-run the Section 7 code audit to confirm no residual
   attacker-controlled-value-into-SVG pattern remains, even on
   the patched version, as defense in depth.

Playbook B — seccomp profile denying shell/interpreter exec from the Node.js container

Prerequisites: container runtime supporting seccomp (Docker Engine or Kubernetes with a seccomp-capable node); a staging environment to validate the profile before production rollout. Reboot required: no (container restart required to apply a new seccomp profile, not a host reboot). Rollback: revert to the previous (or default) seccomp profile reference in the pod spec / docker run invocation and restart the container; keep the prior profile file versioned alongside this one.

{
  "defaultAction": "SCMP_ACT_ALLOW",
  "syscalls": [
    {
      "names": ["execve", "execveat"],
      "action": "SCMP_ACT_ERRNO",
      "comment": "Deny the Node.js process from exec'ing a new program at all; a patched, non-shelling-out app never needs this. Remove/relax if the app has a legitimate execve dependency."
    }
  ]
}

# Kubernetes pod spec reference (apply after validating in staging):
#   securityContext:
#     seccompProfile:
#       type: Localhost
#       localhostProfile: profiles/REPLACE_WITH_PROFILE_FILENAME.json
#
# Docker Engine reference:
#   docker run --security-opt seccomp=REPLACE_WITH_PROFILE_PATH.json REPLACE_WITH_IMAGE

Playbook C — reverse-proxy rule blocking SVG/HTML-shaped payloads on OG-image routes

Prerequisites: administrative access to the reverse proxy / WAF in front of the application; a staging route to validate the rule does not break legitimate requests. Reboot required: no (config reload only). Rollback: comment out or remove the added location/rule block and reload the proxy config; keep the previous config file versioned.

# Example nginx snippet — adjust route paths to match your app's actual
# OG-image / social-preview handlers before deploying.
location ~ ^/(api/og|opengraph-image|twitter-image) {
    if ($args ~* "(%3C|%3E|<|>|javascript:|data:)") {
        return 403;
    }
    proxy_pass http://REPLACE_WITH_UPSTREAM_APP_HOST;
}

# Test from a non-production route before enabling in production:
#   curl -s -o /dev/null -w '%{http_code}\n' \
#     'https://REPLACE_WITH_STAGING_HOST/api/og?value=%3Ctest%3E'
#   (expect 403 once the rule is live)

Playbook D — Falcon detection posture for Q1/Q2

Prerequisites: Falcon sensor deployed on all Next.js application-tier hosts; the Section 11 benign-baseline gate completed. Reboot required: no. Rollback: disable the Custom IOA rule (or revert it from Detect to a saved hunt query) if it proves too noisy after promotion; no endpoint-state change to undo since this playbook only changes Falcon console configuration, not the host.

1. Save Q1 and Q2 (Section 8) as Scheduled Searches scoped to the
   Next.js application-tier host group.
2. Run for 7+ days in audit mode; collect every distinct
   ParentCommandLine / CommandLine pattern that fires.
3. Add each confirmed-benign pattern to the TUNING exclusion list
   in the query (Section 8) before promoting.
4. Promote to a Custom IOA in Detect mode only. Do not enable
   Prevent (auto-kill) without a dedicated production tuning cycle;
   killing a false-positive build/ops process is a self-inflicted
   outage.

Validation gates (Section 11) apply to every Good/Partial row above: none of Q1–Q5 should be promoted to a Custom IOA, and none should be trusted operationally, until the telemetry-ready and benign-baseline gates have been run against the specific tenant deploying this pack.

Full verbatim text of every source above is saved in NextJS-ImageResponse-CVE-2026-94545-Hunt-sources/ alongside this file (01 through 06). No fetched source contained text directed at an AI assistant, a request to fetch further URLs, a claim of administrator/user authority, or an instruction to skip validation — see the provenance note in Section 2.