Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js has shipped an out-of-band security update fixing two critical unauthenticated remote code execution flaws, one in React Server Components and one in the librsvg library used for SVG processing, The Hacker News reports. Both flaws carry a CVSS score of 9.5; fixes are in Next.js 16.4.1 and 15.5.28.