Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js released an out-of-band security update on October 14 addressing two critical remote code execution vulnerabilities and one high-severity denial-of-service flaw. The first RCE flaw resides in React Server Components, potentially allowing unauthenticated attackers to execute arbitrary code. The second RCE vulnerability is in librsvg, an open-source library used by Next.js via the 'sharp' package for SVG image processing. Both flaws are critical severity and require no authentication to exploit. An out-of-band patch was issued outside the normal release cycle, indicating urgency. Administrators and developers using Next.js are urged to apply the fixes immediately. The combination of server-side and image-processing attack surfaces broadens the potential impact across Next.js deployments.