Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js released an out-of-band security update on October 14 fixing two critical remote code execution flaws—one in React Server Components and another in librsvg, used via the sharp package for SVG processing—plus a high-severity denial-of-service flaw. The vulnerabilities allow unauthenticated attackers to execute code, and the fixes are included in the latest versions.