Next.js patches two critical RCE flaws—but version 15 may keep a vulnerable dependency

Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated remote-code-execution flaws and a high-severity denial-of-service bug. Version 15 users should verify that `sharp` is updated too: the Next.js patch may leave an affected version installed.
Source

👉@sysadminoff

https://4sysops.com/archives/next-js-patches-two-critical-rce-flaws-but-version-15-may-keep-a-vulnerable-dependency/