Next.js ImageResponse RCE: Patch 16.3.6 Now — September 22, 2026

Work from the safest step to the harder repair.

1. Step 1. Identify the exact Next.js version in the production lockfile and deployed build. The official September 22 advisory lists versions >=16.2.0 and <16.3.6 as affected.
2. Step 2. Check whether the application uses ImageResponse from next/og and whether that path runs in the Node.js implementation. The advisory says the Edge ImageResponse implementation is not affected by this issue.
3. Step 3. For Next.js 16.3, upgrade to 16.3.6 using the project's normal package-management workflow, regenerate the lockfile if required, and review the dependency diff before committing it.
4. Step 4. If the application is on Next.js 15.5, the advisory says 15.x is not affected by this RCE, but 15.5.26 includes related hardening. Evaluate that update through the normal maintenance process rather than falsely labeling the 15.x app vulnerable to this specific RCE.
5. Step 5. Run the full typecheck, automated tests and production build. Exercise routes that generate Open Graph, social, certificate, report, badge or other images through ImageResponse, because those are the paths most directly connected to the affected component.
6. Step 6. Deploy from a recoverable checkpoint and verify the actual production version after the rollout. A changed package.json in source control is not proof that every running production instance is patched.
7. Step 7. Review logs for failures or anomalous requests around ImageResponse endpoints without collecting or publishing attack payloads. If there is credible evidence of exploitation, move from routine patching to the organization's incident-response process.
8. Step 8. Keep this issue separate from the August 2026 Next.js Windows filesystem RCE and AVIF/libheif image-optimization issues. They have different affected conditions and patched versions, so one patch article should not be used as proof that every other advisory is resolved.

Need the actual code? Go to GenesisCodeDoctor.com to search the Code Store or request code for the exact platform, error, and repair you are working on.

Protect the working site first.

• Patch through the normal dependency workflow and preserve a rollback point before production deployment.
• Keep request bodies, generated SVG content, logs and security-testing artifacts free of secrets, tokens and private user data.
• Use authorized security validation only; this guide intentionally omits exploit payloads and reproduction steps.

Do not turn a repair into a larger outage.

• Do not attempt to reproduce the remote-code-execution path on a production system merely to prove vulnerability.
• Do not claim every Next.js 15.x application is vulnerable; the official September 22 notice says 15.x is not affected by this RCE.
• Do not claim Edge ImageResponse is affected by this issue; Next.js says the Edge implementation is not affected.
• Do not stop at editing the dependency manifest. Verify the lockfile, built artifact and production deployment actually contain the patched version.

Diagnose the exact failure before choosing a repair.

Genesis separates the visible symptom from the underlying technical cause. Run the supported diagnostic first, review the evidence, and then use a matching repair only when the failure is actually verified.

Platform scope

Next.js 16.2–16.3 applications using Node.js ImageResponse from next/og

Category

Next.js · Security releases

Last updated

2026-09-22

Know the complexity before you edit.

Difficulty

Intermediate

Change risk

High

These labels describe implementation complexity and blast radius, not a guaranteed repair time.

Verify time-sensitive platform details at the source.

• Next.js — Security Update for a Critical Upstream Issue (September 22, 2026)

Before you make the change

Continue from easy to harder.

• Next.js Windows RCE CVE-2026-75604: Affected Versions and Patch Checklist
• API Returning 500 Errors? Find the Backend Failure Path