#Next.js
All CosmicBytez Labs articles tagged #Next.js, across news, security advisories, how-to guides, and projects.
- News
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
Vercel shipped an out-of-band fix for two CVSS 9.5 unauthenticated RCE flaws in Next.js caching and SVG processing, plus a high-severity DoS bug.
- Security
CVE-2026-108259: TinaCMS CLI Code Injection via Unescaped Git Branch Name
TinaCMS CLI interpolates raw git branch names into generated JS, letting a crafted branch inject code during CI/CD builds.
- News
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input
CVE-2026-94545 (CVSS 9.5) lets attacker-controlled input reach unescaped SVG output in Next.js ImageResponse, enabling RCE. Patched in 16.3.6.
- News
Next.js Patches Two Critical RCE Flaws — AVIF and Windows Path Traversal
Vercel patched two critical Next.js RCEs: a libheif AVIF heap overflow (CVSS 9.5) and a Windows-only path traversal flaw (CVSS 9.0).
- Security
CVE-2026-52539: Hardcoded JWT Secret in Outstatic CMS Enables Admin Takeover
Outstatic CMS versions up to and including 2.1.9 ship a publicly known default JWT signing secret, allowing unauthenticated attackers to forge valid admin...
- Security
CVE-2026-41248: Clerk.js Middleware Auth Bypass Exposes
A critical authentication bypass vulnerability in Clerk's JavaScript SDK allows crafted HTTP requests to skip createRouteMatcher middleware gating,...
- News
Next.js Creator Vercel Hacked
Vercel confirmed suffering a breach after a hacker claiming to be part of ShinyHunters offered to sell stolen data for $2 million, affecting the company...
- News
Hackers Exploit React2Shell in Automated Credential Theft
Threat actors are running a large-scale, automated campaign exploiting React2Shell (CVE-2025-55182) in vulnerable Next.js applications to steal...
- News
Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts
A large-scale credential harvesting campaign has been observed exploiting the React2Shell vulnerability (CVE-2025-55182) as an initial infection vector,...
- HOWTO
Building Offline-First PWAs with Next.js and SQLite
Learn how to build a Progressive Web App with offline-first architecture using Next.js, SQLite for local storage, and Supabase for cloud sync. Includes...
- HOWTO
IPTV Stream Validation and M3U Playlist Management with FFmpeg
Build a robust IPTV stream management system using FFmpeg for validation, M3U playlist parsing, EPG integration, and automated health monitoring of live...
- HOWTO
Building Desktop Apps with Electron and Next.js
Create cross-platform desktop applications by combining Electron for native capabilities with Next.js for the UI. Covers IPC communication, system tray,...
- HOWTO
Building a Content Platform with Next.js 16 and Contentlayer2
Create a full-featured technical blog platform using Next.js 16 App Router and Contentlayer2 for MDX content management. Covers document types, search,...