Next.js shipped an out-of-band security release on Tuesday to close a remote-code-execution hole in next/og. The bug lives in the Node.js ImageResponse path: improper escaping in the SVG that Satori generates could, under the right conditions, let an attacker run code, thanks to vulnerabilities in upstream dependencies. Versions >=16.2.0 and <16.3.6 are exposed. The fix ships in 16.3.6 on the Active LTS line and 15.5.26 on Maintenance LTS; the advisories are GHSA-vcvr-r3jv-pc5j for Next.js and GHSA-wx4j-mvgx-mqwp for Satori upstream. The 15.x release carries related hardening but isn't vulnerable to the RCE itself. If you generate Open Graph images at runtime, patch now — this is the next/og path, not some edge case.