Vercel Patches Critical Next.js ImageResponse RCE Traced to a Satori SVG-Escaping Flaw
Vercel shipped Next.js 16.3.6 to fix a critical, 9.5-rated remote code execution flaw in ImageResponse rooted in a Satori SVG-escaping bug, CVE-2026-94545.
Signal
6 articles covering "web frameworks"
Vercel shipped Next.js 16.3.6 to fix a critical, 9.5-rated remote code execution flaw in ImageResponse rooted in a Satori SVG-escaping bug, CVE-2026-94545.
Cloudflare has moved Python Workers out of beta to general availability, adding native FastAPI, Django, and Flask support plus PostgreSQL and MySQL connectivity via Hyperdrive.
Angular's June 3 release graduates Signal Forms, Asynchronous Signals, and Angular Aria to stable, flips the default change-detection strategy to OnPush, and ships with Vitest as the default test runner.
SvelteKit shipped versions 2.57.0 through 2.61.0, advancing its experimental remote functions with a new query.live primitive and several breaking changes to queries and forms.
Vercel's Next.js 16.2 delivers an 87 percent reduction in dev server startup time, up to 60 percent faster rendering via a React contribution, and introduces experimental tooling that gives AI coding agents direct access to browser DevTools and component trees from the terminal.
Vercel releases Next.js 16.2 with experimental AI agent tooling, a React contribution that speeds up Server Component rendering by up to 350 percent, Turbopack Server Fast Refresh, and over 200 bug fixes.