https://curasec.metacog.co.kr/tags/next-js/Recent content in Next-Js on CuraSecHugoen-usThu, 15 Oct 2026 15:35:13 +0000https://curasec.metacog.co.kr/insights/2026-10-15-next-js-ships-out-of-band-patch-for-two-critical-rce-flaws-i/Thu, 15 Oct 2026 15:35:13 +0000https://curasec.metacog.co.kr/insights/2026-10-15-next-js-ships-out-of-band-patch-for-two-critical-rce-flaws-i/<ul> <li><strong>Engineer — Plan:</strong> Two critical RCE flaws in a ubiquitous framework warrant priority patching, but with no KEV listing, public PoC, or active exploitation confirmed, this is urgent-but-scheduled rather than drop-everything. Upgrade Next.js to the patched release and audit any transitive use of the sharp/librsvg stack for SVG processing in other services.</li> <li><strong>SOC/IR — Learn:</strong> No IOCs, no confirmed exploitation, and no TTPs to map yet — nothing to hunt or detect today. File awareness of React Server Components and librsvg/SVG processing as future attack surface if exploitation emerges.</li> <li><strong>Leader — Skip</strong></li> </ul>