Next.js shipped two 9.5s out of band. The one most applications are actually exposed to is the 8.2
2026-10-16Security
Three advisories landed together on 14 October. The headlines took the two critical unauthenticated remote code execution flaws, which is the right order by severity and the wrong order for almost every application that runs the framework.