Next.js 16.3.6 fixes a critical remote code execution flaw in next/og
The September 22 release fixes a critical RCE in the Node.js ImageResponse of next/og. Versions 16.2.0 up to 16.3.5 are affected.
What to do
Upgrade to 16.3.6 today. If you skipped the July 20 and August 25 security releases, you have three to catch up on.
The September 22 release fixes a critical remote code execution issue in the Node.js ImageResponse implementation of next/og, caused by improper escaping in SVG output from Satori (GHSA-vcvr-r3jv-pc5j). Affected: 16.2.0 up to 16.3.5. Fixed in 16.3.6.
Next.js 15.x is not affected by the RCE (15.5.26 adds hardening), and the Edge ImageResponse is not affected. It follows security releases on July 20 and August 25.