Our takeNext.js released an out-of-band patch for two critical unauthenticated RCEs (one in React Server Components caching, one via librsvg through sharp for SVGs) plus a high-severity DoS. Update self-hosted instances now; Vercel-hosted apps are already safe.Security Resilience desk
Sources (3)
- hackernews · hackernews
- securityweek · securityweek
- hackernews · hackernews
What this means for you — Security leader:Update all self-hosted Next.js instances to 15.2.3 or later immediately; the two unauthenticated RCEs (React Server Components caching and librsvg/SVG via sharp) are critical and now public.
What this means for you — Lean IT orgs:If you self-host any Next.js websites, update to version 15.2.3 or newer right away. If your sites run on Vercel, the hosting provider has already applied the fixes.
What this means for you — MSP:Audit every client Next.js deployment; push 15.2.3 or later to all self-hosted instances today. Vercel-hosted apps are already patched.
What this means for you — Researcher:Next.js 15.2.3 ships out-of-band fixes for two unauthenticated RCEs (one in React Server Components caching logic, one in librsvg processing through sharp) plus a DoS.