vulnerability
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
HighCVSS 7.8
Summary
Next.js released an out-of-band security update on October 14 to address two critical vulnerabilities and a denial-of-service flaw. The update requires upgrading to Next.js 16.4.1 or 15.5.28, and includes a fix for a denial-of-service issue related to Server Actions.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data