Next.js shipped an emergency patch on September 22 for a 9.5-CVSS remote-code-execution bug, with nine more fixes due September 30: here's what to check if you self-host.
