
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
Next.js 16.4.1 and 15.5.28 patch two critical unauthenticated RCE bugs and a Server Actions denial of service.
3 stories, newest first · one card per story

Next.js 16.4.1 and 15.5.28 patch two critical unauthenticated RCE bugs and a Server Actions denial of service.
Ubuntu reports a librsvg flaw that may allow denial of service or arbitrary code execution.

GNOME 50.5 patches gvfs CVE-2026-88924, Epiphany JavaScript injection and ZIP-slip extension flaws, plus use-after-free bugs in librsvg and GDM.
Today 1.5K readers · 2.4K views · 754 reads · all time 189K views