Provenance Record

Clear News piece (592 words, range 400-1200). Overview, per-advisory breakdown, sharp note, upcoming November release and an explicit What We Don't Know section. Neutral tone, no AI self-reference, no CVSS scores or exploitation claims beyond the sources.

All 10 snapshots (source-0..9.html.gz, HTTP 200, no archive fallback, suspicious_patterns null for all) read and then re-checked live: the four nextjs.org posts by curl text extraction, and the four advisories plus two release tags via the GitHub REST API. (0) Oct 14 post: dated 14 Oct 2026; v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS); lists use cache RCE GHSA-673q-mjm6-r5xr (Critical), Image Optimization SVG RCE CVE-2026-96889 / GHSA-2464-fhr4-w9xw (Critical), App Router Server Actions DoS GHSA-p3m5-59mp-jv5r (High); 'unauthenticated' appears in the post headings; sentence 'two fixes postponed from the September security release due to upstream dependency delays' and 'There is no known workaround for affected applications' are verbatim; sharp >= 0.35.5 workaround confirmed; React upstream advisories GHSA-xqc2-xf4c-x3h3 and GHSA-h3gv-c5rc-p453 are listed but not described (article correctly says not reviewed). (1) Oct 8 notice: 'three vulnerabilities in upstream dependencies: two Critical and one High. Two of these fixes were postponed from the September security release due to upstream coordination'; Wednesday Oct 14 planned. It does not say which two were postponed; the article says so and assigns them to no specific advisory. (2) Sept 30 post: dated 30 Sep; 'A fix for one critical vulnerability and one high severity vulnerability was postponed due to upstream dependency delays' verbatim; v16.3.8/v15.5.27. (3) Oct 27 notice: scheduled release Tuesday Nov 3, 2026, 'will address seven medium vulnerabilities in Next.js'; 'announced' wording is accurate (advance notice, not yet released). (4-6) GitHub API: GHSA-673q: critical, CVSS v4 9.5, AV:N/PR:N/UI:N, no CVE, no CWE, affected >=16.0.0 <=16.4.0, patched 16.4.1 only (16.x only), published 2026-10-14, finder evolutionstorm. GHSA-2464: critical, 9.5, CVE-2026-96889, affected >=10.0.0 <=15.5.27 and >16.0.0 <=16.4.0 (the page's '> 16.0.0' is a typo in the advisory; the article's '>= 16.0.0' is a trivial harmonisation not materially wrong), patched 15.5.28 and 16.4.1, finders randomguy6407 and rafabd1. GHSA-p3m5: high, 8.2, affected >=13.0.0 <=15.5.27 and >=16.0.0 <=16.4.0, patched 15.5.28 and 16.4.1, no credits. The article states no score, CWE or credit, so nothing contradicts them. 'Unauthenticated' is in both RCE advisory titles and corroborated by CVSS PR:None; it is the advisories' own wording, not inference. (7) sharp GHSA-wq5f-xc86-pv6w: title 'Vulnerability in librsvg dependency CVE-2026-96889' exact; affected < 0.35.5; prebuilt binaries in 0.35.5 provide librsvg 2.63.2; sharp.block VipsForeignLoadSvg workaround exact; severity High 8.9 (AV:L), CWE-416; published 2026-09-30 per API and the snapshot (the writer's Oct 6 vs Sep 30 note did not reproduce in the API data I saw). The article gives no sharp publication date or severity, so nothing is contradicted. (8) v16.4.1 release notes (2026-10-14T17:47:59Z) list all three advisories; (9) v15.5.28 (17:47:49Z) lists only the image RCE and the DoS, exactly as the article says. Sourcing is first-party (Vercel/Next.js project, plus the sharp maintainers); no independent third-party coverage, acceptable for a vendor advisory roundup but noted. Allowlist: nextjs.org (line 1138) and github.com (line 1131) both present by exact hostname; no edit needed.

Every number, date, version, GHSA/CVE id, severity label, quote and attribution verified individually; no discrepancies. The use cache RCE is correctly scoped to 16.x only (affected >=16.0.0 <=16.4.0). The title phrase 'Two Fixes Postponed From September' matches the Oct 8 and Oct 14 posts exactly ('two fixes postponed'), and the article does not map the postponement to specific CVEs. Consistent with the Sept 30 report of one critical and one high postponed (the two critical + one high set is compatible, though the posts never say it is the same two). The article makes no claim about the React advisories beyond their existence.

Accurate, carefully hedged follow-up that fully verifies against all ten sources, with an honest statement of what the sources do not say. Ready for publication without corrections. Featured candidacy: 2 - two critical unauthenticated RCE advisories (CVSS 9.5) in a very widely used web framework, patched out-of-band, with a further security release already announced