The Hacker News

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js patches two critical RCE flaws involving typed arrays and SVG processing, plus a Server Actions DoS affecting App Router apps.

Critical vulnerability in Next.js allows 'unauthenticated takeover'. Two weeks since the patch, potential PoC code has emerged, so if you haven't already, update to 16.4.1/…

Next.js released an emergency security update on October 14. Two of the issues are 'Critical' and could allow code execution ...

I implemented security measures under the assumption that more serious problems than PHP or Node.js are coming

In October, a critical vulnerability in PHP and multiple vulnerabilities in Node.js were announced around the same time. Shortly before that, an update regarding a critical vulnerability in Next.js ...