Upgrade to 16.3.6 today. If you skipped the July 20 and August 25 security releases, you have three to catch up on.
Key facts
Severity
Critical
Affected
16.2.0 – 16.3.5
Fixed in
16.3.6
Advisory IDs
GHSA-vcvr-r3jv-pc5j
Not affected
15.x, Edge ImageResponse
The September 22 release fixes a critical remote code execution issue in the Node.js ImageResponse implementation of next/og, caused by improper escaping in SVG output from Satori (GHSA-vcvr-r3jv-pc5j). Affected: 16.2.0 up to 16.3.5. Fixed in 16.3.6.
Next.js 15.x is not affected by the RCE (15.5.26 adds hardening), and the Edge ImageResponse is not affected. It follows security releases on July 20 and August 25.
