securityTwo 9.5s in One Patch Window: The Next.js Emergency Playbook
Vercel's October 14 out-of-band update closes two unauthenticated RCEs rated CVSS 9.5 — one hiding in `use cache`, one in your image pipeline — plus a Server Actions DoS. Here is the operator's order of operations.




