🔴 Critical: Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
-
Next.js has pushed an out-of-band security update addressing two critical vulnerabilities that permit unauthenticated remote code execution, plus a high-severity denial-of-service issue.
The first code-execution flaw affects React Server Components, while the second resides in librsvg — the open-source library that Next.js pulls in via the sharp package for SVG image processing.
The fixes are available in the latest release; administrators running affected versions should prioritize upgrading.
Source: The Hacker News
Are your Next.js deployments already patched, or are you still assessing exposure across your projects?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login