Next.js 16.3.6 fixes critical ImageResponse RCE (CVE-2026-94545) | Hacker News - But Better

Next.js 16.3.6 fixes critical ImageResponse RCE (CVE-2026-94545)nextjs.org

The September 22, 2026 out-of-band security update for Next.js is now available

2 points•joshcsimmons•8 days ago•1 comment•

#js #fixes #critical #rce #cve #imageresponse #critical imageresponse #fixes critical

1 comment

rvz8 days ago

What a disaster.

Read the full thread on Hacker News →

Related stories

CISA active Linux kernel CVEs (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682)github.com
Hacker News · 1 points · 6 days ago
KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066)ethiack.com
Lobsters · 6 points · 2 months ago
TCP SACK PANIC - Kernel vulnerabilities - CVE-2019-11477, CVE-2019-11478 & CVE-2019-11479access.redhat.com
Lobsters · 1 points · over 7 years ago
A free, keyless MCP Server for CVE data and per-CVE internet Exposure
Hacker News · 1 points · 4 days ago
Expat 2.8.5 released, fixes vulnerability CVE-2026-93990blog.hartwork.org
Hacker News · 1 points · 8 days ago
Critical GitLab Auth RCE via Double-Free in Regex Parserdocs.gitlab.com
Hacker News · 1 points · 7 days ago