{"title":"React and Next.js advisories","description":"React, React Server Components and Next.js advisories: framework RCEs, middleware bypasses and patched releases.","home":"https://vulnpocalypse.dev/feeds/","items":[{"id":"https://vulnpocalypse.dev/advisories/symantec-reports-ai-attack-agent-built-to-hijack-exposed-model-endpoints/","title":"Symantec reports AI attack agent built to hijack exposed model endpoints","url":"https://vulnpocalypse.dev/advisories/symantec-reports-ai-attack-agent-built-to-hijack-exposed-model-endpoints/","date":"2026-11-11","summary":"Symantec reports an AI attack agent built to hijack unauthenticated OpenAI-style endpoints, so require authentication on any model endpoint you expose.","tags":["ai-tools","ai-tools","web","nextjs","cloud","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/nextjs-october-2026-security-release/","title":"Next.js October 2026 security release: two critical RCEs, and check your sharp version","url":"https://vulnpocalypse.dev/advisories/nextjs-october-2026-security-release/","date":"2026-11-11","summary":"Next.js 16.4.1 and 15.5.28 fix an unauthenticated RCE via SVG image optimization, a use cache RCE and a Server Actions DoS. Also check sharp is 0.35.5+.","tags":["exploited","nextjs","npm"]},{"id":"https://vulnpocalypse.dev/advisories/react2shell-cve-2025-55182/","title":"React2Shell (CVE-2025-55182): the React Server Components RCE, and why the December patch is not enough now","url":"https://vulnpocalypse.dev/advisories/react2shell-cve-2025-55182/","date":"2026-11-11","summary":"An unauthenticated RCE in React Server Components hit Next.js App Router apps by default. Exploited within hours. A related RCE was fixed in October 2026.","tags":["exploited","npm","nextjs"]}]}