Plan
active
Next.js Critical RCE Patches: React Server Components and librsvg
- Engineer — Plan: Two critical RCE flaws in a ubiquitous framework warrant priority patching, but with no KEV listing, public PoC, or active exploitation confirmed, this is urgent-but-scheduled rather than drop-everything. Upgrade Next.js to the patched release and audit any transitive use of the sharp/librsvg stack for SVG processing in other services.
- SOC/IR — Learn: No IOCs, no confirmed exploitation, and no TTPs to map yet — nothing to hunt or detect today. File awareness of React Server Components and librsvg/SVG processing as future attack surface if exploitation emerges.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.