pwned.coffeeUpdated 38 min ago

The menu

Next.js

Partial outage

3 live incidents affecting Next.js, 3 critical.

Today's specials

  1. criticalpatched Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays next (npm) ## Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays. ## Workaround There is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your… fixed in next 16.4.1no CVE4 sources
  2. criticalpatched Sentry-Javascript: Middleware Bypass when using Tunnel route @sentry/nextjs (npm) ### Impact The `tunnelRoute` option makes the SDK send browser events to a path on your own Next.js server (for example `/monitoring`), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them. The middleware skip was wider… fixed in @sentry/nextjs 9.47.2 +2CVE-2026-1141395 sources
  3. criticalpatched Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used next (npm) ## Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. ## Workaround Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of… fixed in next 15.5.28 +1no CVE5 sources

5 spills in 12 months for Next.js

Week of 1 Dec 2025: 1 newWeek of 28 Sept 2026: 1 newWeek of 19 Oct 2026: 3 new
Worst week: 19 Oct 2026, 3 new spills.

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Past orders

  1. criticalpatched Next.js: Remote Code Execution in next/og ImageResponse next (npm) ## Impact The Node.js `ImageResponse` implementation from `next/og` is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: ```tsx import { ImageResponse } from 'next/og' export async function GET(request:… fixed in next 16.3.6no CVE5 sources
  2. criticalpatchedexploited Meta React Server Components Remote Code Execution Vulnerability Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182. Added to CISA KEV on 2025-12-05 (federal deadline 2025-12-12). CVE-2025-551822 sources

More in Web & runtimes

Follow Next.js

RSS: /feed.xml?stack=nextjs. JSON: /incidents.json?stack=nextjs. Or add it to your usual for delivery.