Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw.One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images.The fixes are in
First seen on thehackernews.com
Jump to article: thehackernews.com/2026/10/nextjs-ships-out-of-band-patch-for-two.html
