CVE-2026-94545

Description

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.

References

https://github.com/Hassham1/CVE-2026-94545-nextjs-og-poc

https://thehackernews.com/2026/09/critical-nextjs-imageresponse-flaw-can.html

https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp

https://github.com/vercel/satori/pull/814

https://github.com/vercel/satori/commit/26a52affc031216fee5882b6e965c8dbc7ac1782

https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j

https://github.com/vercel/next.js/releases/tag/v16.3.6

https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-89994

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS