Vercel

Next.js published an out-of-band update on October 14 for two critical unauthenticated RCE advisories and one high-severity DoS, and has announced a November 3 release of seven medium fixes.

Vercel's Next.js team released 16.3.8 and 15.5.27 fixing one high, five medium and one low severity flaw; a critical and a high fix were postponed over upstream delays.

Vercel shipped Next.js 16.3.6 to fix a critical, 9.5-rated remote code execution flaw in ImageResponse rooted in a Satori SVG-escaping bug, CVE-2026-94545.

Vercel Labs' experimental scriptc compiler turns ordinary TypeScript into small native binaries with no embedded Node or JavaScript engine, now at version 0.1.4 with more than 5,000 GitHub stars.

Slack's new Slack Code feature moves AI coding agents out of private terminals into shared, self-archiving team channels, launching with Anthropic, Cognition, GitHub, and Vercel.

The React team merged a work-in-progress Rust rewrite of the React Compiler, and Vercel says early Turbopack tests found 20-50% faster compilation.

Next.js 15.5.18 and 16.2.6 land with a 13-advisory bundle covering a React Server Components DoS (CVE-2026-23870), middleware-bypass routes, SSRF, and cache poisoning; Vercel says the WAF cannot reliably block them.

A Lumma Stealer infection at AI startup Context.ai escalated into a cross-tenant OAuth attack on Vercel, exposing employee accounts, environment variables, and customer credentials, with attackers reportedly demanding a $2 million ransom in Telegram messages with the company.

Vercel's Next.js 16.2 delivers an 87 percent reduction in dev server startup time, up to 60 percent faster rendering via a React contribution, and introduces experimental tooling that gives AI coding agents direct access to browser DevTools and component trees from the terminal.

Vercel releases Next.js 16.2 with experimental AI agent tooling, a React contribution that speeds up Server Component rendering by up to 350 percent, Turbopack Server Fast Refresh, and over 200 bug fixes.