Security60s read
Next.js Patches Two Critical RCEs, One With No Workaround
The out-of-band release fixes a Cache Components RCE, an SVG image-optimization RCE on glibc Linux, and a Server Actions denial of service.
4 sources
Security
Security Briefs
25 briefs— one-minute reads, curated for senior frontend engineers.
Security59s read
Malicious tensorlake 0.5.144 Turns npm Install Into a Credential Heist
A valid provenance attestation carried the Shai-Hulud worm through the package's own release workflow, and its dead-man switch punishes a fast token revoke.
3 sources
Security54s read
npm Expires Unvalidated Trusted Publishing Configs After 48 Hours
The change closes a window where a renamed or deleted repository name could pass publishing trust to a new owner.
1 source
Security57s read
Next.js 16.3.8 Fixes Image Optimization SSRF and a Cache-Poisoning Cluster
Cross-user cache poisoning in SSG and ISR is the item to act on, and the 15.x line backports only some of the set.
2 sources
Security49s read
serialize-javascript Let a </script> Inside Data Close the Tag
Serialized function bodies were not escaping closing script tags, so anything that inlines the output into HTML hands an attacker a script injection.
1 source
Security46s read
devalue 5.9.2 Rejects Out-of-Bounds Indices That Made parse Quadratic
The Svelte ecosystem's serializer accepted indices past the end of an array, and crafted input could flip between array representations to make parsing quadratic in payload size.
1 source
Security58s read
sharp 0.35.4 Fixes libheif RCE: Critical Upstream, High in the Advisory
sharp below 0.35.4 inherits two libheif flaws rated critical upstream that can reach remote code execution on glibc-based Linux. The fix is a version bump or a one-line AVIF block.
2 sources
Security60s read
CVE-2026-85625: sift Prototype Pollution Scores 9.2, With No Patched Version
CVE-2026-85625 covers sift through 17.1.3 with no patched release: a prototype-pollution path plus default `$where` compilation turns a benign `sift({})` call into arbitrary code execution.
3 sources
Security54s read
Chrome 152.0.7977.75: Two Critical Use-After-Frees in a Follow-Up Security Drop
A week after the 327-fix build, Chrome stable moves to 152.0.7977.75/.76 with 26 fixes, including two Critical use-after-frees in WebGL and Shared Tab Groups that can lead to code execution outside the sandbox.
1 source
Security50s read
Renovate High-Severity Advisory: Malicious GitHub Servers Could Steal Credentials
A high-severity Renovate advisory (CVSS 8.6) can leak your GitHub credentials to an attacker-controlled host through pagination links, and with no workaround you need to upgrade to 44.11.3 or Mend images 15.4.0 before your next run.
1 source
Security55s read
Node.js 24.20.0 (LTS): Runtime Permission Revocation and Audit Mode
Node.js can now revoke permissions at runtime and audit what it would block, so you can harden a production process without a restart.
1 source
Security52s read
Chrome 152 Stable Patches 327 Security Flaws, 10 Critical
Chrome 152's security drop patches 327 flaws, 10 of them Critical with sandbox escapes, and sets the new evergreen baseline every browser build has to reach.
1 source
Security55s read
Next.js August Security Release: Two Critical RCEs Patched Early
Next.js moved its August security release forward to Aug 25, shipping 16.3.3 and 15.5.24 to close two critical RCEs, a Windows-only path traversal and a crafted-AVIF image optimization exploit.
1 source
Security55s read
Cloudflare Shows a Full Remote Spectre Attack Against Workers
Researchers ran a full remote Spectre attack against a co-located Worker in production, and the 360x speedup over 2021 makes serverless co-tenanting look far less safe.
1 source
Security55s read
PACT: Rate-Limit Bots Without Identity, CAPTCHAs, or Attestation
Mozilla's PACT design rethinks web rate limiting as a zero-knowledge exchange where a site learns exactly one bit about you, under the limit or not, with CAPTCHA as the fallback instead of identity or device attestation.
1 source
Security55s read
Astro 7.1 Adds Built-in CSP Support and Pagination URL Fixes
Astro 7.1 ships first-class Content Security Policy support with granular script and style directives, so you can tighten your policy without the classic migration pain.
1 source
Security52s read
High-Severity DoS Vulnerability in React Server Components (CVE-2026-44907)
CVE-2026-44907 (CVSS 7.5) allows unauthenticated remote attackers to trigger CPU exhaustion and OOM conditions via crafted HTTP requests to Server Function endpoints.
2 sources
Security58s read
Next.js Launches Monthly Security Release Program, Patches 9 Vulnerabilities
Next.js shipped its first pre-announced monthly security release on July 20, patching 9 vulnerabilities (4 high severity) across v16.2.11 and v15.5.21.
1 source
Security58s read
Two High-Severity CVEs Patched in Vite: Dev Server WebSocket File Read and fs.deny Bypass
Vite patches CVE-2026-39363 (arbitrary file read via dev server WebSocket) and CVE-2026-39364 (server.fs.deny bypass), affecting versions 6.x, 7.x, and 8.x. Fixed in 6.4.2, 7.3.2, and 8.0.5.
2 sources
Security50s read
TeamPCP Supply Chain Attack Escalates: Poisoned VS Code Extensions Now in Play
The threat group behind the Miasma worm has expanded its attack surface to VS Code extensions, using them as a vector to compromise GitHub accounts and inject malicious code into open source projects.
2 sources
Security50s read
npm v12 Will Default allowScripts to Off, Blocking Automatic Install Script Execution
Coming in July 2026, npm v12 disables automatic install scripts, git dependencies, and remote URL resolution by default. Every frontend team needs an allowlist before the upgrade lands.
1 source
Security50s read
HackerOne Ships Agentic AI Platform to Find and Validate Vulnerabilities
HackerOne launched an AI platform that autonomously discovers and validates security vulnerabilities. It combines agentic AI with the company's existing bug bounty triage data to reduce false positives and speed up remediation.
1 source
Security50s read
5th Chrome Zero-Day of 2026: V8 Engine Bug Exploited in the Wild
CVE-2026-11645 is the fifth Chrome zero-day exploited in 2026, an out-of-bounds read/write in the V8 JavaScript/WebAssembly engine. CVSS 8.8. Patch is in Chrome 149. The pace of Chrome zero-days is accelerating.
2 sources
Security55s read
CVSS 10.0: Azure DevOps Hit With Maximum-Severity Information Disclosure Bug
CVE-2026-42826 lets unauthenticated attackers extract sensitive data from Azure DevOps with zero user interaction. CVSS score of 10.0, the highest possible. Here's what's exposed and how to check if you're patched.
2 sources
Security60s read
npm Supply-Chain Attack Wave: What Frontend Teams Must Audit Now
A coordinated campaign injected malicious code into 14 widely-used npm packages last week. We break down the affected packages, detection steps for your lockfile, and the one CI flag that catches this.
1 source