AI Edge · 8h ago
Next.js patches two critical flaws allowing unauthenticated remote code execution
Vercel issued emergency patches on August 25 for two critical vulnerabilities in Next.js that permit unauthenticated remote code execution, one triggered by maliciously crafted AVIF images and the other via a Windows path traversal flaw.