Website: Next.js security update (16.4.3)
The website moves from Next.js 16.4.0 to 16.4.3, a patch release that closes three published vulnerabilities in versions 16.0.0 to 16.4.0: two remote code executions and a denial of service. The two critical vulnerabilities targeted features this website does not use. No visible change.
- Commit
- 1726430
- Build
- Build success · Target murloc-site
- Fixed vulnerabilities: remote code execution through the image optimization API with SVG files (critical), remote code execution through "use cache" functions returning typed arrays (critical), denial of service through Server Actions (high).
- Update: next 16.4.0 → 16.4.3. The dependency audit no longer reports any vulnerability.
- Checks after deployment: 146 pages generated, all pages, feeds and APIs of the website respond normally.