Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

October 15, 2026 · 12:28 pm 1 sources

Image: The Hacker News

Coverage

More coverage

• Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
  The Hacker News · October 15, 2026 12:28
  Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library…