---
title: Next.js Security Update for a Critical Upstream Issue
description: The September 22, 2026 out-of-band security update for Next.js is now available
url: "https://nextjs.org/blog/nextjs-security-update-september-22-2026"
docs_index: /docs/llms.txt
publishedAt: September 22nd 2026
authors:
  - Josh Story
  - Karim Rahal
  - Sebastian Silbermann
---



An out-of-band security update is now available in v16.3.6 (Active LTS) and v15.5.26 (Maintenance LTS). These releases upgrade upstream dependencies, including Satori, to address an issue that could lead to remote code execution in affected Next.js versions. Version 15.5.26 includes related hardening, but Next.js 15.x is not affected by the remote code execution issue.

Please patch your Next.js dependencies to maintain the security of your applications.

```bash filename="Terminal"
npm install next@16.3.6   # for 16.3
npm install next@15.5.26  # for 15.5 (hardening only)
```

## Impact

### Remote Code Execution in Node.js `ImageResponse` (Critical Severity)

[**GHSA-vcvr-r3jv-pc5j**](https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j) (Next.js)

Related upstream advisory: [**GHSA-wx4j-mvgx-mqwp**](https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp) (Satori)

Next.js versions `>=16.2.0 <16.3.6` are affected.

The issue affects the Node.js `ImageResponse` implementation in `next/og`. Under specific conditions, improper escaping in SVG output generated by Satori could lead to remote code execution due to vulnerabilities in other upstream dependencies. The fix upgrades those dependencies.

Applications using the Edge `ImageResponse` implementation are not affected.

## Our security program

We work with a talented set of researchers to secure Next.js and other open source frameworks through [Vercel's Open Source Bug Bounty](https://hackerone.com/vercel-open-source). Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.

Any questions or concerns regarding our security programs or vulnerability management can be sent to [security@vercel.com](mailto:security@vercel.com).