Next.js Fixes Two Critical Unauthenticated RCE Flaws in Out-of-Band Update Vulnerability Report Next.js Fixes Two Critical Unauthenticated RCE Flaws in Out-of-Band Update Do Son October 15, 2026 0 TL;DR Vercel shipped Next.js 16.4.1 and 15.5.28 on October 14, 2026, in an out-of-band release. The Next.js... Read More Read more about Next.js Fixes Two Critical Unauthenticated RCE Flaws in Out-of-Band Update