[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdKtktlheTsBRSUZ6WZzDIY2jO9HveqcjioSarSOSAA0":3},{"article":4,"iocs":41,"watch_terms":46,"solutions":47,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"6d9cf5fb-3a05-4591-80cb-424db0e0004a","CVE-2026-94545 – ⁠From JSX to SVG Injection","cve-2026-94545-from-jsx-to-svg-injection-7de120","TL;DR – update Next.js to 16.3.6. If you are on Next.js 15 or use the Edge ImageResponse implementation, you are not affected by this vulnerability. Checkmarx SCA already supports detection of this vulnerability, it’s in our database, and scans will automatically flag applications running the affected versions, so customers using Checkmarx don’t need to hunt […]","A new vulnerability, CVE-2026-94545, has been discovered in Next.js, allowing for JSX to SVG injection. Users running Next.js versions prior to 16.3.6 are advised to update immediately. The vulnerability does not affect Next.js 15 or the Edge ImageResponse implementation. Checkmarx's SCA tool already supports detection and will flag affected applications.","Next.js 16.3.6 update addresses CVE-2026-94545, an SVG injection vulnerability.","https:\u002F\u002Fcheckmarx.com\u002Fzero-post\u002Fcve-2026-94545-from-jsx-to-svg-injection\u002F","https:\u002F\u002Fcheckmarx.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FFrom-_JSX_to_SVG_Injection_codeline.png","2026-09-23T18:38:29+00:00","2026-09-23T20:00:20.780564+00:00",8,[17,20],{"name":18,"type":19},"Next.js","product",{"name":21,"type":22},"Checkmarx","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[42],{"type":43,"value":44,"context":45},"cve","CVE-2026-94545","Vulnerability identifier",[21,18],{"controls":48,"vendors":134},[49,78,107],{"slug":50,"name":51,"problem":52,"products":53},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":79,"name":80,"problem":81,"products":82},"patch-management","Automated patch management","Known holes get closed in days, not months.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":108,"name":109,"problem":110,"products":111},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[112,118,126],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":113,"product_name":114,"url":116,"description":117},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":149},"nextjs-jsx-to-svg-injection-flaw-demands-immediate-upgrade","Next.js JSX-to-SVG Injection Flaw Demands Immediate Upgrade","CVE-2026-94545 exposes a JSX-to-SVG injection vulnerability in Next.js versions prior to 16.3.6, which could allow attackers to inject malicious SVG content through JSX rendering pathways. SVG injection can be weaponized to execute cross-site scripting (XSS) attacks, exfiltrate data, or manipulate the DOM in unexpected ways, making this a high-severity concern for any application that renders user-influenced content. The fact that a widely-used framework like Next.js carries this flaw highlights the critical importance of tracking third-party dependency versions continuously. Delayed patching in web frameworks often translates directly into exploitable attack surfaces in production environments.",[140,141,142,143,144,145,146,147,148],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","NIST SP 800-53 SI-2 (Flaw Remediation)","NIST SP 800-53 SA-15 (Development Process, Standards, and Tools)","NIST SP 800-161 (Supply Chain Risk Management)","OWASP A06:2021 – Vulnerable and Outdated Components","OWASP A03:2021 – Injection","ITIL Change Management – Emergency Change Procedure","GDPR Article 32 – Security of Processing (timely patching as technical measure)",{}]