An out-of-band security update is now available in v16.3.6 (Active LTS) and v15.5.26 (Maintenance LTS). These releases upgrade upstream dependencies, including Satori, to address an issue that could lead to remote code execution in affected Next.js versions. Version 15.5.26 includes related hardening, but Next.js 15.x is not affected by the remote code execution issue.
Please patch your Next.js dependencies to maintain the security of your applications.
Next.js versions >=16.2.0 <16.3.6 are affected.
This is an excerpt. The full article is published by Next.js Blog.
Continue reading at Next.js Blog