Next.js Secures Framework with Nine Critical Patch Updates

Why ship nine CVEs in one drop?

Vercel just published nine security advisories for Next.js and pushed a single coordinated patch — 15.5.21 for the 15.x line and 16.2.11 for 16.x. That's a quietly impressive amount of hygiene work for a framework this big. The issues include two SSRFs in request-routing features, a middleware/proxy bypass, a DoS path through Server Actions, two cache confusion bugs, and an Image Optimization crash that takes malicious SVG as input. All fixed in one release. The alternative — nine advisories discovering each other piecemeal over weeks — is the kind of thing that makes security teams pull their hair out. So: hats off to Vercel for the coordination and to researcher KarimPwnz for the reporting.

---

This is an excerpt. Read the full post at otf-kit.dev/blog/nextjs-security-patches — full-stack kits your AI coding agent can actually ship to production. Browse the kits →