#nextjs
-
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws
On October 14 Vercel fixed two critical remote-code-execution flaws — in React Server Components and in the librsvg library — plus a high-severity denial-of-service bug.
-
Critical Next.js flaw: server code execution via a crafted SVG
ImageResponse, the feature that generates social preview images, can under certain conditions let an attacker run code on the server. Vercel shipped a fix on September 22.
-
Next.js Patches Two Critical Remote Code Execution Vulnerabilities
Vercel has shipped out-of-band patches for Next.js: one flaw is exploited through a malicious AVIF file, the other through path traversal on Windows servers. Both allow code execution without authentication.