<![CDATA[🔴 Critical: Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing]]>

<![CDATA[🔴 Critical: Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing]]>Next.js has pushed an out-of-band security update addressing two critical vulnerabilities that permit unauthenticated remote code execution, plus a high-severity denial-of-service issue.

The first code-execution flaw affects React Server Components, while the second resides in librsvg — the open-source library that Next.js pulls in via the sharp package for SVG image processing.

The fixes are available in the latest release; administrators running affected versions should prioritize upgrading.

Source: The Hacker News

Are your Next.js deployments already patched, or are you still assessing exposure across your projects?

]]>https://xploitlk.com/topic/716/critical-next.js-ships-out-of-band-patch-for-two-critical-rce-flaws-in-caching-and-svg-processingRSS for NodeTue, 27 Oct 2026 08:18:36 GMTSat, 17 Oct 2026 06:30:18 GMT60