Skip to content
What are you looking for?. Open searchSR

Tags

Dependencies

2 items
NEXT.JS16.3.6patches remote code execution in next/og
Toolsstrong signal

Next.js 16.3.6 closes a critical remote code execution hole in next/og

The out-of-band release is available as 16.3.6 on Active LTS and 15.5.26 on Maintenance LTS. Versions from 16.2.0 up to but not including 16.3.6 are affected through the Node.js ImageResponse implementation in next/og, where improper escaping in Satori's SVG output can lead to remote code execution. Applications on the Edge implementation are not affected, and Next.js 15.x does not carry the remote code execution issue at all. The fix works by upgrading the upstream dependencies, Satori among them.

Next.jsverified

NODE.JS26.10.0debounce and throttle stop being a dependency
Toolsmedium signal

Node.js 26.10.0 adds debounce and throttle to the standard library

The release arrived on September 22, 2026 and contains no security fixes. Both new functions return a promise for whatever the wrapped function produced, accept an AbortSignal, and say exactly what happens to a call they decide not to run. Throttle also carries a concurrency limit, a queue depth and a choice between queueing the overflow and rejecting it. Nine further changes are marked semver-minor, among them a synchronous openAsBlob and a way to hand a bound socket to a worker thread.

Node.jsverified