Vercel patches two critical unauthenticated RCE bugs in the Next.js framework.
Attackers can exploit a Server-Side Request Forgery flaw in self-hosted Next.js to bypass firewalls and steal IAM credentials and API…