Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-94545
By Ido Mizrahi |
23 September 2026
CVE-2026-94545 – Next.js next/og Node.js ImageResponse SVG injection enables RCE
Next.js next/og Node.js ImageResponse is vulnerable to an upstream issue that can enable RCE when attacker-controlled input is rendered into SVG content/attributes/styles during image generation. Affects npm next versions `>=16.2.0