Next.js maintainers have released an out-of-band security update addressing two critical remote code execution vulnerabilities and a high-severity denial-of-service flaw.
Two critical Next.js flaws allow unauthenticated remote code execution on Windows-hosted applications using the Image Optimization API to process AVIF images. The first flaw, tracked as CVE-2026-75604 ...
A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said. The risk ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results