{"uuid": "ca5026d0-5647-4019-a0e0-2106980ca08c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mw7oos2rfw2s", "content": "\ud83d\udea8 CVE-2026-94545: Critical RCE in Next.js 16.2.0\u201316.3.5 via SVG injection when attacker-controlled input reaches ImageResponse. Next.js 15 and Edge ImageResponse are unaffected.\n\ud83d\udc49 Update to 16.3.6.\nDetails: buff.ly/74eZfz1", "creation_timestamp": "2026-09-23T21:28:21.016035Z"}