Next.js has released an out-of-band security update to address two critical remote code execution (RCE) flaws and a high-severity denial-of-service vulnerability. One RCE flaw affects React Server Components, while the other is in librsvg, used for SVG image handling via the ‘sharp’ package. These unauthenticated RCE vulnerabilities are severe, and immediate patching to versions 11.4.10, 11.3.19, and 10.6.19 is strongly recommended.