Affected Next.js versions: >=16.2.0, <16.3.6 (Source: Next.js security update (v16.3.6 and v15.5.26 release notice))
What happened
Next.js has issued an out-of-band security update, v16.3.6 (Active LTS) and v15.5.26 (Maintenance LTS), to address an issue that could lead to remote code execution in affected versions. The Next.js security update labels the issue "Critical Severity". The related upstream advisory, filed against the Satori library, is GHSA-wx4j-mvgx-mqwp.
Which deployments are in scope
Next.js versions >=16.2.0 <16.3.6 are affected. The issue sits in the Node.js ImageResponse implementation in next/og. According to Next.js, under specific conditions improper escaping in SVG output generated by Satori could lead to remote code execution, due to vulnerabilities in other upstream dependencies. The fix upgrades those dependencies.
Two groups are outside the affected scope. Applications using the Edge ImageResponse implementation are not affected. Next.js 15.x is not affected by the remote code execution issue either, although version 15.5.26 includes related hardening.
Why it matters to an organisation
Exposure here depends on two facts that only an organisation's own engineers can confirm: which Next.js version each application runs, and whether image generation runs on the Node.js or the Edge runtime. An external scan can see neither. The advisory also places the flaw in upstream dependencies, so the component that needs updating may not be one a development team chose directly.
The advisory text reviewed for this story does not state whether exploitation has been observed, and it does not give a CVSS score or a CVE identifier. The upstream reference it provides is GHSA-wx4j-mvgx-mqwp. Those are questions for the security team to check against the full advisory and their own telemetry.
How common the framework is among detected sites
WebPulse scanned the Tranco top 10,000 domains in September 2026. Of those, 7,064 responded and a platform was detected on 2,491. Next.js accounted for 791 of the detected sites, or 31.8%. Detection identifies the framework only. It does not reveal the version or whether next/og is used, so the figure shows how widely the framework is deployed in that sample. It does not show how many sites are exposed.
What to ask your team
1. Which of our applications run Next.js between 16.2.0 and 16.3.5, and which are already on 16.3.6 or later? Ask for the answer from lockfiles and build artifacts, not from memory.
2. Which of those applications use ImageResponse from next/og, and do they run it on the Node.js runtime or the Edge runtime? Only the Node.js implementation is affected.
3. Do our teams on 15.x plan to move to 15.5.26 for the related hardening, even though 15.x is not affected by the remote code execution issue?
4. Who watches upstream advisories such as GHSA-wx4j-mvgx-mqwp, and how long did it take from the release of the patched versions to a patched build in production? Ask for the actual timestamps.
5. Does our software bill of materials record transitive dependencies such as Satori, so that a flaw like this can be traced to the applications that ship it?
