Next.js 16.3.6 Fixes a Critical Remote Code Execution Flaw in next/og ImageResponse

What happened

On 22 September 2026 the Next.js project published version 16.3.6. The release notes contain a single line: the release carries a security fix for advisory GHSA-vcvr-r3jv-pc5j, titled "Remote Code Execution in next/og ImageResponse". A 15.5.26 release was published at the same time; its notes were not reviewed for this story.

What we know

• The advisory rates the issue Critical with a CVSS v4 score of 9.5. It lists affected versions as 16.2.0 up to but not including 16.3.6, with 16.3.6 as the patched version.
• The Node.js implementation of ImageResponse from next/og is "affected by an upstream vulnerability" that can lead to remote code execution.
• An application is affected when it passes attacker-controlled values into SVG content, attributes or styles during image generation. The advisory's example reads a query-string parameter straight into an SVG <title>.
• Applications that use the Edge ImageResponse implementation, or that never pass attacker-controlled values into SVG, are not affected according to the advisory.
• The stated workaround, if upgrading is not immediately possible, is to stop passing attacker-controlled values into SVG content, attributes or styles rendered by the Node.js implementation.

What is not yet confirmed

The advisory does not name the upstream component or say whether the flaw has been exploited. Versions before 16.2.0 are not listed as affected, but the advisory does not spell out why. VoltKit did not reproduce the issue.

Why it matters

Dynamic Open Graph images are one of the most common uses of next/og, and many implementations build the image from URL parameters, which is exactly the pattern the advisory warns about. Upgrading to 16.3.6 is the straightforward fix. VoltKit's own image routes take no request input, and the site has been moved to 16.3.6 regardless.