Node.js patched a high-severity Brotli decompression vulnerability that could allow remote code execution
- More topics
Security patch
PHP released fixes for two critical unauthenticated RCE flaws (CVE-2026-109618 and CVE-2026-109619); upgrade to 8.2.35, 8.3.36, 8.4.27, or 8.5.12
Next.js fixed critical unauthenticated RCE in App Router Cache Components when use cache functions return multiple typed arrays; affected applications must upgrade to a patched version
Next.js fixed critical RCE in SVG image optimization on glibc-based Linux (CVE-2026-96889); upgrading Next.js or using sharp 0.35.5 or later addresses the vulnerable dependency
Next.js fixed a high-severity DoS in App Router apps using Server Actions, where crafted requests can consume CPU and block other requests; Pages Router apps are unaffected
Nginx 1.30.6 and 1.31.7 patched memory-corruption flaws in specific alias/rewrite, map/regex, and AIO/SSI configurations; exploitation can crash workers and may enable RCE under additional conditions