Khoury College of Computer Sciences
CS 4550 / CS 5610 · Web Development · Fall 2026
Next.js 16.3.6 / 15.5.26: patch Node.js ImageResponse RCE now
- Next.js
- Security
- Course
Instructor-curated digest, not original reporting. Each post paraphrases a public article and links to the original source.
On September 22, 2026, the Next.js team published an out-of-band security update. Next.js 16.3.6 (Active LTS) and 15.5.26 (Maintenance LTS) upgrade upstream dependencies, including Satori, to address an issue that could lead to remote code execution. Version 15.5.26 includes related hardening, but Next.js 15.x is not affected by the remote code execution issue.
The critical issue is remote code execution in the Node.js ImageResponse path in next/og (GHSA-vcvr-r3jv-pc5j), with related upstream advisory GHSA-wx4j-mvgx-mqwp for Satori. Next.js versions >=16.2.0 and <16.3.6 are affected. Improper escaping in SVG output from Satori could lead to RCE via other upstream dependencies; the fix upgrades those dependencies. Applications using the Edge ImageResponse implementation are not affected.
That upgrade is the same framework and dependency hygiene as Chapter 1 and the Node packages in Chapter 5; follow the original Next.js post for upgrade commands and advisory details.
Read original: Next.js Security Update for a Critical Upstream Issue — Next.js