Last week we announced an upcoming security release for Next.js. A fix for one critical vulnerability and one high severity vulnerability was postponed due to upstream dependency delays.
Updates are now available in v16.3.8 (Active LTS) and v15.5.27 (Maintenance LTS) to address these issues. Please patch your Next.js dependencies to maintain the security of your applications.
An attacker-controlled, allow-listed remote URL can lead to Server-Side Request Forgery (for example to private IP ranges) during Image Optimization. If no images.remotePatterns are configured, your application is not affected.
Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page…
This is an excerpt. The full article is published by Next.js Blog.
Continue reading at Next.js Blog