New that day
- criticalpatched Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays next (npm) ## Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays. ## Workaround There is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your…
- criticalpatched Pillow multi-frame loaders can reuse stale native image storage after mode transitions Pillow (pip) ### Summary Pillow multi-frame image loaders can retain native `ImagingCore` storage allocated for one frame while changing the Python-side image `mode` and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as `L`, and a later frame of the same dimensions switches to a wider mode such as `RGB` or `CMYK`, Pillow may…
- criticalpatched Sentry-Javascript: Middleware Bypass when using Tunnel route @sentry/nextjs (npm) ### Impact The `tunnelRoute` option makes the SDK send browser events to a path on your own Next.js server (for example `/monitoring`), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them. The middleware skip was wider…
- criticalpatched Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used next (npm) ## Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. ## Workaround Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of…