BigCommerce has released Catalyst 1.14.0, an update to its headless e-commerce storefront framework that removes exposure to vulnerable versions of Next.js affected by CVE-2026-94545. The underlying security flaw can potentially allow remote code execution (RCE) when a Next.js application generates images using attacker-controlled content.
The vulnerability carries a critical severity rating of 9.5 out of 10 under CVSS 4.0. It affects Next.js versions 16.2.0 through 16.3.5 when specific image-generation functionality is used in the Node.js runtime.
BigCommerce confirmed in its November 12, 2026 release notes that Catalyst 1.14.0 upgrades Next.js to version 16.4.3, moving the storefront framework beyond the affected versions.
However, this is not a newly discovered vulnerability in the core BigCommerce SaaS platform. CVE-2026-94545 was originally disclosed on September 22, 2026, and concerns the Next.js framework used by certain headless storefront implementations.
Importantly, installing an affected Next.js version does not automatically make a store exploitable. Successful exploitation requires a specific image-generation implementation that processes attacker-controlled data in an unsafe manner.
What Is CVE-2026-94545?
CVE-2026-94545 is a critical remote code execution vulnerability associated with the ImageResponse functionality available through the next/og module in Next.js.
Next.js is a React-based framework commonly used to build modern websites and applications. In e-commerce, it is frequently used for headless storefronts, where the customer-facing website communicates with a separate commerce backend through APIs.
One of its capabilities is generating images dynamically on the server.
These images are often used as Open Graph previews, which appear when someone shares a product page, category page, or other website URL through social networks and messaging applications.
Next.js provides the ImageResponse API to generate such images from JSX content.
The security issue originates from an upstream dependency involved in converting content into SVG markup. Under certain conditions, improperly escaped attacker-controlled values can alter the generated SVG structure and lead to remote code execution in the Node.js implementation.
The official Next.js security advisory GHSA-vcvr-r3jv-pc5j identifies versions 16.2.0 through 16.3.5 as affected and version 16.3.6 as the first patched release.
The advisory also explains that applications using the Edge implementation of ImageResponse, or applications that never pass attacker-controlled values into generated SVG content, attributes, or styles, are not affected by this particular attack.
Why Is This Vulnerability Relevant to BigCommerce?
BigCommerce is a SaaS e-commerce platform that provides catalog management, customer accounts, orders, payments, and other commerce services.
Merchants can use its traditional storefront architecture or build a customized headless storefront connected to the BigCommerce backend.
Catalyst is BigCommerce’s modern headless storefront framework, built using Next.js, React, and the BigCommerce GraphQL Storefront API.
Unlike a traditional hosted theme, a Catalyst storefront can be customized at the application-code level and deployed to supported hosting environments.
This flexibility allows developers to create sophisticated shopping experiences, but it also makes the security of the underlying application framework and its dependencies important.
On November 12, 2026, BigCommerce published Catalyst 1.14.0.
According to the official Catalyst 1.14.0 release notes, the update introduces Next.js 16.4.3 and explicitly moves the framework away from versions affected by CVE-2026-94545.
This provides a clear security benefit for developers maintaining Catalyst-based storefronts.
The relevant distinction is that the vulnerability affects a Next.js component potentially used by a Catalyst storefront, not the entire BigCommerce commerce infrastructure.
There is no basis for claiming that every BigCommerce merchant was exposed or that the platform’s managed checkout, customer database, and payment infrastructure were directly vulnerable to CVE-2026-94545.
Which Next.js Versions Are Affected?
The official Next.js advisory identifies a specific affected version range.
| Component | Affected versions | Security fix |
|---|---|---|
| Next.js next/og ImageResponse | 16.2.0 through 16.3.5 | 16.3.6 |
| BigCommerce Catalyst | Exposure depends on the installed Next.js version and implementation | Catalyst 1.14.0 includes Next.js 16.4.3 |
The affected Next.js release range is confirmed by the framework’s maintainers.
It should not be assumed that every earlier Catalyst release contains the vulnerable Next.js versions. The actual dependency version must be checked in the deployed project.
Likewise, a custom Catalyst installation may use dependencies that differ from those originally included in its base release.
The safest approach is to inspect the application dependency tree and the deployed runtime rather than relying exclusively on the Catalyst version number.
How Does the Next.js ImageResponse Vulnerability Work?
The vulnerability involves dynamically generated images and the processing of SVG content.
To understand the risk, it is useful to examine how modern applications create social-sharing previews.
1. A storefront generates a dynamic image
A headless online store may generate an image containing a product name, brand, price, or other information.
For example, when a product page is shared online, the storefront might create a promotional image containing the product title and a background graphic.
Next.js provides the ImageResponse API for generating these images directly from application components.
In a typical implementation, the application processes some input data and uses it to construct the image.
That data may originate from the product catalog, the URL, request parameters, or other application sources.
2. User-controlled information enters the image-generation process
The dangerous scenario begins when information controlled by an external user is inserted into the generated image without appropriate restrictions.
Potential sources include:
- URL query parameters used to customize image text.
- Dynamic route parameters.
- User-submitted product reviews or other storefront content.
- Request headers or other untrusted request values.
- External data sources whose content is not adequately validated.
These are possible input sources, not evidence that a standard Catalyst installation uses all of them.
The important condition is that an attacker can influence content eventually passed into the vulnerable image-generation functionality.
3. The image-generation dependency processes unsafe SVG content
Next.js uses supporting libraries to transform JSX-based image descriptions into output suitable for rendering.
The underlying vulnerability involves improper escaping of certain values before they are incorporated into SVG markup.
SVG is an XML-based image format that describes graphical elements, text, attributes, and styles.
When untrusted values are inserted into SVG without correct escaping, specially constructed content may be interpreted as markup rather than ordinary text.
This can alter the structure of the generated image.
In the vulnerable Node.js implementation of ImageResponse, the resulting processing chain can allow an attacker to reach a remote code execution condition.
4. Malicious processing may reach the application server
The official advisory confirms that the vulnerability can result in remote code execution.
This is more serious than a visual error in a generated image.
Successful RCE means an attacker may be able to execute code within the context of the affected server-side process.
Depending on the runtime permissions and deployment architecture, this could potentially expose environment variables, application configuration, accessible secrets, or other resources available to that process.
It does not automatically imply that the attacker obtains root access to the underlying server or complete control of BigCommerce’s hosted backend.
The practical consequences depend on the permissions of the affected execution environment.
Why Is CVE-2026-94545 Rated Critical?
The Next.js advisory assigns the vulnerability a CVSS 4.0 score of 9.5.
That score reflects the potential severity of remote code execution when the required exploitation conditions are present.
The published assessment identifies a network attack vector, low attack complexity, no requirement for prior attacker privileges, and no required victim interaction.
It also identifies additional attack requirements.
Those requirements are particularly important because the vulnerability cannot be exploited simply by identifying a website running Next.js.
The application must use the affected image-generation implementation and allow attacker-controlled content to reach the vulnerable SVG processing path.
A high CVSS rating therefore describes the potential impact of the confirmed vulnerability, not the likelihood that every Catalyst storefront is exploitable.
Does CVE-2026-94545 Affect Every BigCommerce Store?
No. BigCommerce supports multiple storefront architectures, and the confirmed vulnerability is specific to the affected Next.js implementation.
Traditional BigCommerce storefronts
Stores using the traditional BigCommerce Stencil storefront architecture do not automatically use the Catalyst Next.js framework.
The CVE-2026-94545 advisory does not identify Stencil itself as a vulnerable component.
Merchants using a standard hosted BigCommerce storefront should not interpret this announcement as proof that their storefront is exposed to this Next.js vulnerability.
Headless BigCommerce storefronts using Catalyst
Catalyst-based stores require closer examination because Catalyst uses Next.js.
However, the framework version alone is not enough to establish exploitability.
Administrators must also determine whether the storefront uses the Node.js implementation of ImageResponse with attacker-controlled SVG content, attributes, or styles.
A Catalyst deployment that does not expose such functionality is not affected by the documented attack path.
Custom headless storefronts
Some merchants build custom Next.js applications that communicate with the BigCommerce APIs without using Catalyst.
Those applications should be assessed separately.
A custom storefront using a vulnerable Next.js release and the affected image-generation pattern may require remediation even when it is not based on Catalyst.
The determining factors are the actual framework version, runtime, and image-generation implementation.
Which Hosting Environments Are Potentially Affected?
Catalyst storefronts can operate on different hosting platforms, including BigCommerce Storefront Hosting and compatible third-party Next.js environments.
However, hosting location alone does not determine whether CVE-2026-94545 can be exploited.
The advisory specifically identifies the Node.js ImageResponse implementation as vulnerable.
Applications using the Edge implementation of ImageResponse are not affected by this particular issue.
Therefore, administrators should establish the runtime used by the relevant image-generation route rather than assuming that every server-side image endpoint is vulnerable.
A deployment using Cloudflare infrastructure should not automatically be classified as safe or unsafe without checking how the affected functionality executes.
The same principle applies to stores deployed through Vercel or another Next.js hosting provider.
How to Check Whether a Catalyst Storefront Uses an Affected Next.js Version
Administrators with access to the storefront’s source code should begin by checking the resolved Next.js version.
Open the relevant Catalyst project directory and inspect its package dependencies.
For a project using pnpm, the following command can help identify the installed Next.js version:
pnpm list next --depth 0Depending on the project’s workspace structure, it may be necessary to run this command from the actual storefront package directory.
Another useful command is:
pnpm why nextThis displays dependency information that can help establish why Next.js is installed and which package is responsible for its inclusion.
The administrator should also inspect the relevant package lockfile, because the deployed version may be determined by the lockfile rather than the version range written in package.json.
If the resolved version is between 16.2.0 and 16.3.5, the next step is to inspect how the application uses next/og.
How to Identify Potentially Vulnerable Image-Generation Routes
Developers should search the application source code for references to ImageResponse and next/og.
Relevant files may include dynamic Open Graph image routes, custom API handlers, or components responsible for generating social-sharing images.
A repository search for these identifiers provides a practical starting point:
ImageResponse
next/og
opengraph-imageFor each matching implementation, review the following questions:
- Does the route use the Node.js implementation of ImageResponse?
- Does it accept values originating from an HTTP request?
- Can visitors influence the text, attributes, or styles included in the generated SVG?
- Can user-generated content reach the image-generation component?
- Does the route rely on the affected Next.js version?
- Is the same code deployed in production?
If the application does not use the vulnerable implementation or does not pass attacker-controlled data into the relevant SVG content, the documented RCE scenario does not apply.
Conversely, a vulnerable version combined with a publicly accessible, affected image-generation route should be treated as a high-priority security issue.
Do not attempt to validate a production storefront by submitting malicious SVG payloads. Review the implementation and confirm the installed dependency versions in a controlled environment.
How to Update BigCommerce Catalyst to Version 1.14.0
BigCommerce provides an official upgrade mechanism for existing Catalyst projects.
The Catalyst upgrading documentation explains how the CLI merges changes from a newer Catalyst release into an existing storefront project.
The process is designed to preserve customizations where possible, while identifying changes that require manual conflict resolution.
Step 1: Back up the storefront source code
Before upgrading, ensure the project is committed to version control and that a known working deployment can be restored.
Catalyst is a customizable storefront framework, so production stores may contain modifications to checkout-related interfaces, product displays, analytics, integrations, and other components.
An upgrade should not overwrite these modifications without review.
BigCommerce recommends starting with a clean Git working tree.
Step 2: Preview the upgrade
Where the project uses the current Catalyst CLI, administrators can preview a target-version upgrade before modifying the source code.
pnpm catalyst upgrade 1.14.0 --dry-runThe dry-run operation allows developers to inspect the intended changes and identify possible merge conflicts.
Projects created with older Catalyst tooling may require the Catalyst CLI to be installed before this command is available.
Step 3: Apply the update
After reviewing the planned changes, upgrade the project:
pnpm catalyst upgrade 1.14.0The CLI uses the project’s current base version and the selected target version to perform a three-way merge.
Changes that can be applied automatically are staged, while conflicting modifications require manual resolution.
Developers should inspect the resulting changes before committing them.
Step 4: Install updated dependencies
After resolving any merge conflicts, install the dependencies specified by the updated project:
pnpm installBigCommerce notes that the upgrade command does not automatically install all updated dependencies.
Therefore, the installation step is necessary whenever the upgrade changes the project’s dependency definitions.
Step 5: Verify the Next.js version
After updating dependencies, check the resolved version again:
pnpm list next --depth 0Catalyst 1.14.0 officially includes Next.js 16.4.3.
The deployed application must actually use a patched Next.js release. Changing a version number in a configuration file without rebuilding and redeploying the storefront does not protect an existing production deployment.
Step 6: Test and redeploy the storefront
Build the updated application and test the critical shopping workflows before deployment.
At minimum, verify:
- Product and category page rendering.
- Cart creation and quantity changes.
- Checkout navigation and payment redirection.
- Customer sign-in and account sessions.
- Product search and category filtering.
- Custom integrations and middleware.
- Dynamic image generation and social-sharing previews.
- Any customized server-side routes or API handlers.
After successful testing, deploy the updated storefront using the hosting environment’s normal release procedure.
Finally, verify that production is serving the updated build rather than an older container, deployment artifact, or cached application release.
What Else Changes in Catalyst 1.14.0?
Although the Next.js dependency update is the most relevant change for CVE-2026-94545, Catalyst 1.14.0 also contains other improvements.
The release updates the display of pick-list products in the shopping cart, improves analytics initialization, fixes category filtering behavior, and corrects certain session redirect issues in server actions.
It also updates telemetry handling for storefronts running on Cloudflare Workers.
These changes matter because upgrading a customized storefront may require reviewing code beyond the vulnerable dependency.
For example, projects with customized cart components, analytics initialization, or instrumentation files may need to reconcile their local changes with the updated framework implementation.
Developers should therefore test the complete storefront rather than assuming that a dependency upgrade cannot affect existing commerce functionality.
What If an Immediate Upgrade Is Not Possible?
The official Next.js security advisory provides a specific temporary mitigation.
If upgrading cannot be completed immediately, applications should avoid passing attacker-controlled values into SVG content, attributes, or styles rendered using the vulnerable Node.js ImageResponse implementation.
For a Catalyst storefront, that means reviewing and restricting affected dynamic image-generation functionality.
Possible temporary measures include disabling an exposed dynamic image route or ensuring that it renders only trusted content.
Merely filtering a few suspicious characters should not be treated as a complete solution.
The preferred remediation remains installing a patched Next.js version and deploying the corrected application.
Can Cloudflare or a Web Application Firewall Prevent CVE-2026-94545?
A web application firewall may provide additional protection against suspicious requests, but it should not be considered a reliable replacement for patching the vulnerable dependency.
The documented problem involves application-level processing of attacker-controlled data during image generation.
A request may reach the affected functionality through an otherwise legitimate image-generation endpoint.
Because the security issue occurs when the application processes data, generic firewall rules may not reliably identify every dangerous input.
Similarly, ordinary rate limiting does not correct the underlying vulnerability.
Administrators should prioritize updating the vulnerable framework and reviewing the handling of untrusted input.
Could Attackers Access Customer Data or Payment Credentials?
Remote code execution can potentially have serious consequences, but the practical impact depends on the resources available to the affected application process.
A successful attack against a vulnerable Node.js image-generation route may allow access to resources that the process can read or modify.
In a headless commerce storefront, those resources could potentially include application environment variables, configuration information, or API credentials available to the running process.
However, this does not establish that an attacker can automatically access BigCommerce’s managed customer database, payment processor infrastructure, or stored card information.
The confirmed issue is remote code execution within the affected Next.js execution environment, subject to the conditions described in the advisory.
If a production installation is suspected of having been compromised, administrators should assess the permissions and credentials available to the affected runtime rather than assuming that all commerce infrastructure has been breached.
Has CVE-2026-94545 Been Exploited Against BigCommerce Stores?
The official Next.js advisory confirms the vulnerability and its potential remote code execution impact.
BigCommerce separately confirms that Catalyst 1.14.0 moves the framework away from the affected Next.js versions.
However, these sources do not establish that attackers have successfully exploited CVE-2026-94545 against production BigCommerce Catalyst storefronts.
Confirmed exploitation of this vulnerability against BigCommerce storefronts: Not established.
The existence of a public vulnerability description does not prove that a particular Catalyst deployment was exploitable or compromised.
Administrators should evaluate their own applications using the confirmed affected version range, runtime requirements, and data flow into image generation.
BigCommerce Catalyst and CVE-2026-94545: Technical Summary
| Parameter | Confirmed details |
|---|---|
| Vulnerability | CVE-2026-94545 |
| Security advisory | GHSA-vcvr-r3jv-pc5j |
| Underlying software | Next.js |
| Affected component | Node.js ImageResponse implementation from next/og |
| Vulnerability type | Potential Remote Code Execution (RCE) |
| CVSS 4.0 score | 9.5 — Critical |
| First public disclosure | September 22, 2026 |
| Vulnerable Next.js versions | 16.2.0 through 16.3.5 |
| First patched Next.js version | 16.3.6 |
| Required attack conditions | Node.js ImageResponse processing attacker-controlled SVG content, attributes, or styles |
| Edge ImageResponse implementation | Not affected by the documented vulnerability |
| BigCommerce Catalyst update | 1.14.0 |
| Catalyst update announcement | November 12, 2026 |
| Next.js version in Catalyst 1.14.0 | 16.4.3 |
| Confirmed attacks against BigCommerce stores | Not confirmed |
Frequently Asked Questions
Is CVE-2026-94545 a vulnerability in BigCommerce itself?
No. The vulnerability affects specific versions and functionality of Next.js, which is used by BigCommerce Catalyst. The official advisory does not identify the BigCommerce SaaS commerce backend as vulnerable.
Does every BigCommerce merchant need to update Catalyst?
Only merchants using Catalyst have a Catalyst application to update. Stores using the traditional Stencil architecture are not automatically affected by this Next.js issue.
Does every Catalyst storefront running an affected Next.js version have an exploitable RCE vulnerability?
No. Exploitation requires the vulnerable Node.js ImageResponse implementation and attacker-controlled input reaching the affected SVG processing path.
Which Next.js version fixes CVE-2026-94545?
Next.js 16.3.6 is the first confirmed patched version.
Which Next.js version does Catalyst 1.14.0 include?
BigCommerce confirms that Catalyst 1.14.0 includes Next.js 16.4.3.
Can the vulnerability be exploited without a customer account?
The advisory’s CVSS assessment does not require prior attacker privileges. However, the application must expose the specific vulnerable image-generation behavior.
Are Cloudflare Workers deployments affected?
The documented vulnerability concerns the Node.js ImageResponse implementation. The Edge ImageResponse implementation is not affected. Developers should check the actual runtime of the image-generation route rather than relying solely on the hosting provider’s name.
Does upgrading Next.js automatically update a running storefront?
No. The updated dependencies must be incorporated into the application build and deployed to the production environment.
Have attacks against BigCommerce stores been confirmed?
The reviewed official advisories do not confirm real-world exploitation of CVE-2026-94545 against BigCommerce Catalyst storefronts.
What BigCommerce Store Owners and Developers Should Do
The publication of Catalyst 1.14.0 provides an opportunity for merchants using BigCommerce’s headless storefront framework to review their application dependencies and address a critical vulnerability in the Next.js ecosystem.
Store owners should first establish whether their storefront is based on Catalyst, the traditional Stencil architecture, or a fully custom headless implementation.
For Catalyst-based storefronts, developers should check the actual Next.js dependency version and inspect any image-generation functionality that processes data controlled by external users.
Applications using the vulnerable Node.js ImageResponse implementation should be updated to a patched Next.js release. Catalyst 1.14.0 provides Next.js 16.4.3, which is outside the confirmed affected range.
Before deploying the updated framework, test shopping cart operations, checkout navigation, customer sessions, analytics, custom integrations, and image-generation routes to ensure that existing commerce functionality remains operational.
The central security lesson is that SaaS commerce platforms can still have independently maintained storefront applications whose dependencies require attention.
BigCommerce’s managed commerce infrastructure and a customized Catalyst frontend are separate components. Understanding that distinction helps merchants identify where updates are required and avoid treating every critical framework advisory as a confirmed compromise of the underlying commerce platform.
For stores operating an affected Catalyst configuration, the priority is clear: verify the Next.js version, review untrusted data handling in ImageResponse, and deploy a patched storefront.
0 comments