Next.js Security Update Addresses Critical RCE Flaws in React Server Components and SVG Processing

Next.js released an out-of-band security update on October 14 to address two critical remote code execution (RCE) vulnerabilities in React Server Components and librsvg via the sharp package, alongside a high-severity denial-of-service flaw.

Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw.

One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images.

The fixes are in

Read original article