Topic
Critical vulnerabilities and patch cycles in application frameworks such as Next.js.
Next.js released versions 16.4.1 and 15.5.28 on October 14 to fix two unauthenticated code-execution flaws that Vercel rated CVSS 9.5. As of October 15 the caching flaw had no CVE and no workaround, so npm audit may stay quiet and only the upgrade closes it.
Reality
Django 6.1 raised its default PBKDF2 iteration count from 1.2M to 1.5M, adding about 50 to 90ms of CPU per login in a dev.to benchmark. The same tests show each stored hash rewritten on its owner's next login, including hashes deliberately set stronger than the new default.
Reality
Next.js's bundled http-proxy 1.18.1 stamps Content-Length: 0 on chunked DELETE and OPTIONS rewrites, so a hidden second request reaches the backend. Whether it reaches anything sensitive depends on how the next hop frames requests and which internal routes the backend opens to its proxy.
Reality
CVE-2026-94545 lets attacker-supplied text in an Open Graph image reach Next.js dependencies. Vercel shipped the fix on September 22 in 16.3.6; a day later, npm audit still passed affected builds.
Reality
GreyNoise's January tally of React2Shell traffic shows payload text mutating freely while the client tooling behind it stays nearly fixed. That decides what a perimeter rule should match on.
Reality