Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws

Next.js released an out-of-band security update on October 14 fixing two critical flaws that allow unauthenticated remote code execution, plus a high-severity denial-of-service flaw. One RCE is in React Server Components, the other in librsvg, which Next.js uses via the sharp package to process SVG images.

• Out-of-band patch released on October 14
• Two critical unauthenticated RCE flaws
• RCE in React Server Components and librsvg
• High-severity DoS flaw also fixed