Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

AI Summary

Next.js issued an out-of-band patch on October 14 fixing two critical unauthenticated RCE flaws — one in React Server Components and one in librsvg via the sharp image-processing package — plus a high-severity DoS flaw. Any Next.js deployment processing SVG images or using React Server Components is potentially exposed, and the out-of-band nature of the release signals the severity warrants immediate upgrade.

Read full article → https://thehackernews.com/2026/10/nextjs-ships-out…

Relevance score: 86.0/100

# More from October 16

1
Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads The Hacker News
2
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation The Hacker News
3
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability The Hacker News
4
Microsoft drops an actively exploited zero-day among record high of 1,413 vulnerabilities CyberScoop
5
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud The Hacker News
7
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App The Hacker News
8
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages The Hacker News
9
Fridge hack costing millions and sparking fires stemmed from poor security Ars Technica Security
10
UK Legal Aid Agency: Hackers stole records dating back to 1978 BleepingComputer