Last week we announced an upcoming out-of-band security update for Next.js, including two fixes postponed from the September security release due to upstream dependency delays.
Updates are now available in v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS) to address these issues. Please patch your Next.js dependencies to maintain the security of your applications.
A vulnerability in applications using App Router with Cache Components can lead to unauthenticated remote code execution when a use cache function returns multiple typed arrays. There is no known workaround for affected applications. You should upgrade immediately even if your application does not have similar functions.
A memory-related vulnerability in an upstream library used for Image Optimization can lead to remote code execution when Next.js runs…
This is an excerpt. The full article is published by Next.js Blog.
Continue reading at Next.js Blog