nextjs
Next.js ships two unauthenticated RCEs in one release
Vercel's 2026-10-14 security releases (v16.4.1 and v15.5.28) fix three vulnerabilities: two critical unauthenticated remote code execution bugs and one high-severity denial of service. One of the RCEs has no workaround.