#CVE-2026-75604

Next.js Rushes Fixes for Two Critical Bugs That Let Attackers Run Code Without Logging In

Vercel patched flaws in the popular web framework that could be triggered by a booby-trapped image or a rigged URL on Windows servers.