Next.js fixed critical unauthenticated RCE in App Router Cache Components when use cache functions return multiple typed arrays; affected applications must upgrade to a patched version
- Event type
- Security patch
Next.js
The React framework for building web applications, maintained by Vercel.
Next.js fixed critical RCE in SVG image optimization on glibc-based Linux (CVE-2026-96889); upgrading Next.js or using sharp 0.35.5 or later addresses the vulnerable dependency
- Event type
- Security patch
Next.js fixed a high-severity DoS in App Router apps using Server Actions, where crafted requests can consume CPU and block other requests; Pages Router apps are unaffected
- Event type
- Security patch