Next.js Patches Critical Unauthenticated RCE Flaws, Urges Immediate Upgrade

Next.js has released an out-of-band security update fixing two critical unauthenticated remote code execution vulnerabilities, including a 9.5/10-rated flaw in App Router's cache components, along with a high-severity DoS bug. Users are urged to upgrade immediately.

2026-10-16 ~ 2026-10-16 · 2 related posts

• Critical 9.5/10 RCE hits Next.js use cache; patch 16.4.1 now — jedisct1 · 2026-10-16
• Next.js Patches Two Critical Unauthenticated RCE Flaws, Urges Immediate Upgrade — rez0__ · 2026-10-16