Next.js patches remote code execution flaw in next/og across v15 and v16 branches

·1 views

On September 22, 2026, Next.js maintainer eps1lon released two versions simultaneously — v16.3.6 and v15.5.26 — both addressing a security issue in the next/og ImageResponse component. Version 16.3.6 explicitly references a Remote Code Execution vulnerability identified as GHSA-vcvr-r3jv-pc5j, while v15.5.26 describes the change as 'security hardening' without citing its own GHSA code. Both releases were published within one minute of each other, suggesting a coordinated response to the same underlying vulnerability across active branches. Neither release note mentions new features or general bug fixes, indicating these were purely security-focused updates. The parallel releases raise questions about the long-term support scope of the 15.x branch, though a single pair of releases is insufficient to draw conclusions about its full maintenance policy.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Uses Response Size Fingerprinting to Identify Real MCP Tool Callers

Ofir Baranes, an autonomous AI agent operator, devised a method to identify which clients genuinely invoked tools on his MCP server by analyzing HTTP response sizes logged in nginx. Since each MCP request type produces a distinct response size, only calls returning 34,264 bytes confirmed actual tool invocations rather than mere capability checks. On September 23, two crawlers — BrickBlueBot and SaSame-MCP-Audit — were verified as having made real tool calls, distinguishing them from several other bots that stopped at the tools/list stage. A later app log recorded two additional tool invocations with no corresponding nginx entries, leaving those calls unexplained. Baranes notes that two corroborated real-world tool calls from identifiable crawlers is meaningful but not yet conclusive proof of broader adoption.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Proper DNS Setup Is Critical for SaaS Email Deliverability

Misconfigured email DNS records are a common but costly oversight for SaaS founders, often causing legitimate emails to land in spam or leaving domains vulnerable to spoofing attacks. Emails sent by a platform typically fall into three categories: direct, transactional, and marketing, each with different deliverability risks. Experts recommend separating marketing emails from transactional ones using distinct subdomains to protect sender reputation. Key DNS records involved include MX records for routing incoming mail, SPF records for authorizing sending servers, and additional authentication mechanisms to prevent impersonation. A developer with five years of SaaS experience shared these configuration lessons to help others avoid the deliverability pitfalls they encountered early on.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Software Engineer Tracks Sleep and Mood for 90 Days While Testing Chakra Crystals

A backend engineer with eight years of experience spent 90 days systematically tracking sleep scores, mood ratings, and focus hours while using chakra crystals, after his partner introduced him to the practice. He spent $103 on a starter kit and individual stones, testing each one in roughly two-week intervals following the traditional chakra order. While some metrics improved — such as his sleep score rising from 71 to 74 and panic wakeups decreasing — he noted that behavioural changes, like reduced pre-bed phone use, likely explained much of the improvement. A side project he had procrastinated on for eight months was finally completed during the experiment, though he attributed that more to daily accountability logging than to any crystal. He concluded the experiment was an n=1, unblinded self-study with significant confounders, framing it as a personal diary with charts rather than scientific evidence.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Vite+ Chapter 4: How Vite+ Handles Monorepos With Smart Task Caching

Vite+, a developer toolchain built on Vite, introduces a feature called Vite Task designed to manage dependency-aware task execution in monorepos. As projects grow to include multiple apps and shared packages, running every build, test, and lint task after each change becomes inefficient. Vite+ addresses this by mapping dependency relationships between packages, so only affected tasks are triggered when a specific package changes. The tool also supports task caching, preventing redundant work when inputs have not changed. This makes Vite+ particularly useful in large-scale repositories where dozens of packages and hundreds of tasks must be coordinated efficiently.

0 comments Read more at DEV Community