#web-security

Critical Next.js RCE Flaws: What Teams Running Next.js Must Do

Vercel patched two critical unauthenticated RCE flaws in Next.js — a Windows path traversal (CVSS 9.0) and an AVIF image bug. Here's who's affected and how to fix it.