DeserializationNeeds attention

An unauthenticated attacker can run code in rare apps whose RSC payloads mix several typed arrays with attacker input. Public proof-of-concept code exists; React, Vercel and CISA had not reported exploitation as of November 11.

Update Next.js to 16.4.1 or later (15.5.28 on 15.x) or react-server-dom-* to a fixed 19.x release, then check the deployed version. Updating React alone does not fix Next.js.

• Next.js advisory
• Next.js security update
• React advisory