Vercel
Next.js ImageResponse Bug Forces an Off-Schedule Critical Patch
Next.js shipped an unscheduled critical RCE patch for ImageResponse (CVSS 9.5), breaking the monthly security cadence Vercel set up in July.
Topic
Next.js
3 articles tagged Next.js.
Vercel
Next.js Patches Two Unauthenticated RCEs in a Single Release
Two critical unauthenticated RCE bugs, one in AVIF image handling and one Windows-only, forced Next.js to patch a day early.
Vercel
Next.js Now Warns You a Patch Is Coming Before It Says Why
Vercel's new Next.js Security Release Program pre-announces patch dates and severity, then ships. Its first drop fixed 9 bugs, 4 of them high severity.