{"vulnerability": "CVE-2026-94545", "sightings": [{"uuid": "290f075a-080b-4f90-8e73-36557029a416", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mw6iine23k2e", "content": "A critical vulnerability (CVE-2026-94545, CVSS 9.5) in Next.js versions 16.2.0 through 16.3.5 allows remote code execution via the ImageResponse feature [\u2026]", "creation_timestamp": "2026-09-23T10:04:52.962608Z"}, {"uuid": "ca5026d0-5647-4019-a0e0-2106980ca08c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mw7oos2rfw2s", "content": "\ud83d\udea8 CVE-2026-94545: Critical RCE in Next.js 16.2.0\u201316.3.5 via SVG injection when attacker-controlled input reaches ImageResponse. Next.js 15 and Edge ImageResponse are unaffected.\n\ud83d\udc49 Update to 16.3.6.\nDetails: buff.ly/74eZfz1", "creation_timestamp": "2026-09-23T21:28:21.016035Z"}, {"uuid": "b11145c5-8c19-4213-a972-749b26123583", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwaa7kbv5s2t", "content": "Your link preview just got a day job, Morty. Next.js ImageResponse on Node (CVE-2026-94545, CVSS 9.5) can launder a URL into SVG, then into server shell via Satori. Patch is 16.3.6. Edge version shrugs. Even the thumbnail freelances now. day267.012", "creation_timestamp": "2026-09-24T02:41:58.651078Z"}, {"uuid": "d0361730-a208-49db-b567-93c4a930e1de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwabvl6f5o2n", "content": "Next.js RCE Vulnerability CVE-2026-94545: Critical ImageResponse Flaw Enables Remote Code Execution\uff08Next.js\u306b\u91cd\u5927\u306aRCE\u8106\u5f31\u6027\u3001ImageResponse\u3078\u306e\u7d30\u5de5\u3055\u308c\u305fSVG\u5165\u529b\u3067\u30b3\u30fc\u30c9\u5b9f\u884c\uff09 #SecurityOnline (Sep 23)\n\nsecurityonline.info/nextjs-rce-v...", "creation_timestamp": "2026-09-24T03:12:09.299235Z"}, {"uuid": "a8e9a02e-80b0-4589-875e-675e2740645a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "https://t.me/thehackernews/10135", "content": "\u203c\ufe0f Next.js patched a critical ImageResponse flaw that can lead to server code execution.\n\n\"CVE-2026-94545\" affects 16.2.0 through 16.3.5 on Node.js when attacker-controlled values reach generated SVG. The fix is 16.3.6.\n\nInside the bug: https://thehackernews.com/2026/09/critical-nextjs-imageresponse-flaw-can.html", "creation_timestamp": "2026-09-23T07:12:34.000000Z"}, {"uuid": "adf85058-ea12-44f4-8094-7a5d1e410ebb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "https://t.me/CyberDispatch/3069", "content": "Next.js patched a critical ImageResponse flaw that can lead to server code execution.\n\n\"CVE-2026-94545\" affects 16.2.0 through 16.3.5 on Node.js when attacker-controlled values reach generated SVG. The fix is 16.3.6.", "creation_timestamp": "2026-09-24T06:26:15.000000Z"}, {"uuid": "58794f51-4aea-43bf-91b7-c26428d0c840", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "https://t.me/GithubRedTeam/103144", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-94545-nextjs-og-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hassham1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 14:52:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-94545 / GHSA-vcvr-r3jv-pc5j \u2014 Next.js next/og ImageResponse SVG injection (Satori, GHSA-wx4j-mvgx-mqwp): isolated Docker validation lab with vulnerable (16.3.5) vs patched (16.3.6) controls, non-destructive Python scanner with pixel-level PNG evidence, and root-cause analysis of the upstream Satori fix. Authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-23T15:06:05.000000Z"}, {"uuid": "37bc78d4-8345-4a45-9553-78dceb648195", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103144", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-94545-nextjs-og-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hassham1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 14:52:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-94545 / GHSA-vcvr-r3jv-pc5j \u2014 Next.js next/og ImageResponse SVG injection (Satori, GHSA-wx4j-mvgx-mqwp): isolated Docker validation lab with vulnerable (16.3.5) vs patched (16.3.6) controls, non-destructive Python scanner with pixel-level PNG evidence, and root-cause analysis of the upstream Satori fix. Authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-23T15:06:05.000000Z"}, {"uuid": "45b2d05d-de57-41ad-a193-d96ae6431e56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "Telegram/casOb_urBwXkBUZvllR9Y1soseAr2u2g5tENUUxRQxBEAPw", "content": "", "creation_timestamp": "2026-09-24T03:00:06.000000Z"}, {"uuid": "faa77273-1402-48bd-9135-8a198048e789", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "Telegram/3LdrFlR-LEY1MNMAeK2_oak7FbRFWnHvSLklHTRJ1hQ0h1g", "content": "", "creation_timestamp": "2026-09-23T11:00:12.000000Z"}, {"uuid": "ecfc1d21-8290-47ef-a417-48dc0865a7af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "Telegram/vqsPZgWgWmhUgO5aL_wpY6AtnbvKlpjOuzz_MF4q41HEYi4", "content": "", "creation_timestamp": "2026-09-23T15:00:06.000000Z"}, {"uuid": "ed53f3ae-e3b6-4e27-908d-def674bb751c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "https://t.me/bdufstecru/3480", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 ImageResponse \u043f\u0430\u043a\u0435\u0442\u0430 next/og \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Next.js \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u043c \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0438\u043b\u0438 \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-15201\nCVE-2026-94545\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/vercel/satori/commit/26a52affc", "creation_timestamp": "2026-09-25T13:52:47.000000Z"}, {"uuid": "12a5129a-4576-45a5-8bf5-839b256e78d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3480", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 ImageResponse \u043f\u0430\u043a\u0435\u0442\u0430 next/og \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Next.js \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u043c \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0438\u043b\u0438 \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-15201\nCVE-2026-94545\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/vercel/satori/commit/26a52affc", "creation_timestamp": "2026-09-25T13:52:47.000000Z"}, {"uuid": "4e375ea8-f94e-4874-9fe1-a8930fc04383", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "exploited", "source": "Telegram/3LdrFlR-LEY1MNMAeK2_oak7FbRFWnHvSLklHTRJ1hQ0h1g", "content": "", "creation_timestamp": "2026-09-23T11:00:12.000000Z"}, {"uuid": "8195b5eb-55fd-48b6-9de8-44d1e76f3f7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "published-proof-of-concept", "source": "Telegram/vqsPZgWgWmhUgO5aL_wpY6AtnbvKlpjOuzz_MF4q41HEYi4", "content": "", "creation_timestamp": "2026-09-23T15:00:06.000000Z"}, {"uuid": "4ff84c85-338c-4bc6-982a-e37ef5c988ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "https://t.me/ViralCyber/26355", "content": "\ud83d\udd34\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 Next.js \u0628\u0627 \u0642\u0627\u0628\u0644\u06cc\u062a \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RCE)\n\u25c0\ufe0f\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2026-94545 \u0628\u0627 \u0634\u062f\u062a \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 \u0642\u0627\u0628\u0644\u06cc\u062a ImageResponse \u0627\u0632 \u067e\u06a9\u06cc\u062c next/og \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0636\u0639\u0641 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u0628\u0627 \u062a\u0632\u0631\u06cc\u0642 \u0645\u062d\u062a\u0648\u0627\u06cc \u0645\u062e\u0631\u0628 SVG \u062f\u0631 \u0641\u0631\u0627\u06cc\u0646\u062f \u062a\u0648\u0644\u06cc\u062f \u062a\u0635\u0627\u0648\u06cc\u0631 \u067e\u0648\u06cc\u0627\u060c \u062a\u062d\u062a \u0634\u0631\u0627\u06cc\u0637 \u0645\u0634\u062e\u0635\u060c \u06a9\u062f \u062f\u0644\u062e\u0648\u0627\u0647 \u062e\u0648\u062f \u0631\u0627 \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f. \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 16.2.0 \u062a\u0627 \u067e\u06cc\u0634 \u0627\u0632 16.3.6 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f.\n\n\u2b05\ufe0f\u0627\u0642\u062f\u0627\u0645 \u0636\u0631\u0648\u0631\u06cc: \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u062a\u06cc\u0645\u200c\u0647\u0627\u06cc \u062a\u0648\u0633\u0639\u0647 \u0648 \u0627\u0645\u0646\u06cc\u062a\u060c \u0636\u0645\u0646 \u0627\u0631\u062a\u0642\u0627\u06cc Next.js \u0628\u0647 \u0646\u0633\u062e\u0647 16.3.6 \u06cc\u0627 \u0628\u0627\u0644\u0627\u062a\u0631\u060c \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u067e\u0631\u062f\u0627\u0632\u0634 SVG \u0648 \u0648\u0631\u0648\u062f\u06cc\u200c\u0647\u0627\u06cc \u063a\u06cc\u0631\u0642\u0627\u0628\u0644\u200c\u0627\u0639\u062a\u0645\u0627\u062f \u062f\u0631 \u062a\u0648\u0644\u06cc\u062f \u062a\u0635\u0627\u0648\u06cc\u0631 Open Graph \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0631\u062f\u0647 \u0648 \u0644\u0627\u06af\u200c\u0647\u0627\u06cc \u0645\u0631\u062a\u0628\u0637 \u0631\u0627 \u0627\u0632 \u0646\u0638\u0631 \u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0627\u062d\u062a\u0645\u0627\u0644\u06cc \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u067e\u0627\u06cc\u0634 \u06a9\u0646\u0646\u062f.\n\n#NextJS #RCE #CyberSecurity #CVE\n\n\ud83d\udcf1 @PingChannel \n\u062e\u0628\u0631\u060c \u062a\u062d\u0644\u06cc\u0644\u060c \u0627\u0646\u062a\u0642\u0627\u062f - \u0641\u0646\u0627\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f", "creation_timestamp": "2026-09-25T12:20:39.000000Z"}, {"uuid": "47513fde-aa76-4dc6-b211-e9f213acbdf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "published-proof-of-concept", "source": "https://t.me/critical_bug/1828", "content": "\ud83d\udd25 \u0401\u0411\u0410\u041d\u042b\u0419 SVG: \u043e\u0434\u043d\u0430 \u0441\u0441\u044b\u043b\u043a\u0430 \u2014 \u0438 Next.js \u043e\u0442\u0434\u0430\u0451\u0442 \u0445\u0430\u043a\u0435\u0440\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435!\n\n\u0412 Next.js \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 next/og \u0438 ImageResponse. \u0415\u0441\u043b\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0432\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 URL \u0438\u043b\u0438 \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0432\u0432\u043e\u0434\u0430 \u0432 SVG-\u043a\u043e\u043d\u0442\u0435\u043d\u0442, \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u0438\u043b\u0438 \u0441\u0442\u0438\u043b\u0438, \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 Node.js-\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435.\n\n\ud83d\ude31 \u0412 \u0447\u0451\u043c \u043f\u0440\u0438\u043a\u043e\u043b?\n\nImageResponse \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 JSX \u0432 SVG \u0447\u0435\u0440\u0435\u0437 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 Satori, \u0430 \u0437\u0430\u0442\u0435\u043c \u0440\u0435\u043d\u0434\u0435\u0440\u0438\u0442 \u0435\u0433\u043e \u0432 PNG. \u0418\u0437-\u0437\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u043c\u043e\u0433\u043b\u0438 \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043a\u0430\u043a \u0447\u0430\u0441\u0442\u044c SVG-\u0440\u0430\u0437\u043c\u0435\u0442\u043a\u0438, \u0430 \u043d\u0435 \u043a\u0430\u043a \u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u0442\u0435\u043a\u0441\u0442.\n\n\ud83d\udca5 \u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a\u0438:\n\n\u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 OG-route \u2192 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0439 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u2192 SVG injection \u2192 Satori/ImageResponse \u2192 image-processing pipeline \u2192 JavaScript \u0432 Node.js \u2192 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u041e\u0421\n\n\ud83d\udea8 \u0427\u0442\u043e \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439?\n\n\u2014 \u0434\u043e\u0441\u0442\u0443\u043f \u043a .env, API-\u043a\u043b\u044e\u0447\u0430\u043c \u0438 \u0442\u043e\u043a\u0435\u043d\u0430\u043c;\n\u2014 \u043f\u0430\u0440\u043e\u043b\u0438 \u043e\u0442 \u0431\u0430\u0437 \u0434\u0430\u043d\u043d\u044b\u0445;\n\u2014 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c;\n\u2014 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e;\n\u2014 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 Node.js-\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b:\n\n\u2014 Next.js >=16.2.0 \u0438 <16.3.6;\n\u2014 Node.js-\u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f ImageResponse;\n\u2014 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0433\u0434\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0439 \u0432\u0432\u043e\u0434 \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0432 SVG.\n\nEdge-\u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f ImageResponse \u044d\u0442\u0438\u043c \u0432\u0435\u043a\u0442\u043e\u0440\u043e\u043c \u043d\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u0430. \u0412\u0435\u0442\u043a\u0430 Next.js 15 \u043d\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u0430 \u043e\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u043c\u0443 RCE, \u043d\u043e \u0432\u0435\u0440\u0441\u0438\u044f 15.5.26 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 security hardening.\n\n\ud83d\udee1 \u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c?\n\n1\ufe0f\u20e3 \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Next.js \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0434\u043e 16.3.6.\n\n2\ufe0f\u20e3 \u041f\u0435\u0440\u0435\u0441\u043e\u0431\u0440\u0430\u0442\u044c production artifact \u0438 \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u0442\u0430\u0440\u044b\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b.\n\n3\ufe0f\u20e3 \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c ImageResponse, opengraph-image, twitter-image \u0438 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u044b /api/og.\n\n4\ufe0f\u20e3 \u0423\u0431\u0440\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0439 \u0432\u0432\u043e\u0434 \u0438\u0437 SVG content, attributes \u0438 styles.\n\n5\ufe0f\u20e3 \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u0438 Satori, \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a OG-route \u0438 \u0434\u043e\u0447\u0435\u0440\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0435 \u043e\u0442 node.\n\n\ud83d\udd17 \u0420\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435: https://eh.su/reports/cve-2026-94545-remote-code-execution-v-next-js-next-og-cherez-imageresponse-i-svg-injection\n\n#NextJS #CVE202694545 #RCE #SVG #ImageResponse #Satori #NodeJS #AppSec #CyberSecurity", "creation_timestamp": "2026-09-26T18:13:37.000000Z"}, {"uuid": "ff404eb0-0efe-4961-bf31-96c7f8ca5ffc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "https://t.me/GithubRedTeam/103731", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-94545\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a EQSTLab\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 07:58:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNext.js RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-29T08:00:08.000000Z"}, {"uuid": "37c5a0a0-b87d-4c9e-b31d-8deed7491098", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103731", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-94545\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a EQSTLab\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 07:58:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNext.js RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-29T08:00:08.000000Z"}]}