Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.

The version of Next.js installed on the remote host is 16.2.0 prior to 16.3.6. It is, therefore, affected by a remote code execution vulnerability in the Node.js ImageResponse implementation from next/og, due to an upstream vulnerability, when attacker-controlled values are passed into SVG content, attributes, or styles during image generation.

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version
    0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This
    can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is
    consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications
    that cannot immediately upgrade should not render attacker-controlled content with Satori.
    (CVE-2026-94545)

The Next.js Framework on the remote host is affected by a remote code execution vulnerability:

  - The Node.js ImageResponse implementation from next/og is affected by an upstream Satori vulnerability.
    Satori does not properly escape certain values before including them in generated SVG output, which can     allow crafted values to be interpreted as SVG markup. Applications that pass attacker-controlled values     into SVG content, attributes, or styles during image generation can be led to remote code execution.
    (CVE-2026-94545)

Exploitation additionally requires that the application uses the Node.js ImageResponse implementation from next/og and passes attacker-controlled values into SVG content, attributes, or styles. Applications using the Edge ImageResponse implementation are not affected. Nessus cannot verify how the application invokes ImageResponse, so this finding is reported as a potential vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115753	Next.js 16.2.0 < 16.3.6 Remote Code Execution	Web App Scanning	Component Vulnerability	Version Based	medium
477620	SCA: security update for satori (GHSA-wx4j-mvgx-mqwp)	Tenable Cloud Security	SCA Checks	Local	medium
477620	SCA: security update for satori (GHSA-wx4j-mvgx-mqwp)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
362680	Next.js Framework 16.2.x / 16.3.x < 16.3.6 RCE	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-94545

medium

Tenable Plugins

medium

medium

medium

medium