Vercel
2 articles
BreakingCVE
Next.js image optimizer SSRF and cache poisons in September 2026 release
How to fix CVE-2026-94483: upgrade next to 15.5.27 or 16.3.8
HOL GuardBreakingGhsa
CVE-2026-94545 Next.js next/og ImageResponse RCE (GHSA-vcvr-r3jv-pc5j)
How to fix CVE-2026-94545: upgrade next to 16.3.6 (15.5.26 hardening if you stay on 15.x)
HOL GuardRelated topics
Keep exploring
The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.