Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js has released a security update to address two critical remote code execution flaws. These vulnerabilities allow for unauthenticated remote code execution and are located in React Server Components and librsvg, an open-source library used for handling SVG images through the sharp package. The update also fixes a high-severity denial-of-service flaw. The security update was released on October 14. The flaws are considered critical and could be exploited by unauthenticated attackers. The fixes are intended to prevent these vulnerabilities from being exploited.