Vulnerability in Vercel Next
CVE-2026-94545
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.
Published · last modified .
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Vercel Next — versions >= 16.2.0, < 16.3.6
- Vercel Satori — versions >= 0.0.27, < 0.33.5
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp
- github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j
- github.com/vercel/satori/pull/814
- github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e
- github.com/vercel/satori/commit/26a52affc031216fee5882b6e965c8dbc7ac1782
- github.com/vercel/next.js/releases/tag/v16.3.6
Frequently asked questions
- What is CVE-2026-94545?
- CVE-2026-94545 is a vulnerability in Vercel Next, classified under Improper Encoding or Escaping of Output. Published 2026-09-30.
- Is CVE-2026-94545 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.