Next.js just got its worst vulnerability ever, CVSS 8.6.
→ affects versions 13.4.13 , 14.x, 15.x, and 16.0.0–16.2.4
→ attackers can access your internal services, cloud credentials, API keys, and admin panels
→ no authentication needed
→ one crafted request is all it takes
→ roughly 79,000 instances are exploitable right now
→ vercel-hosted apps are safe, self-hosted are not
upgrade to 15.5.16 or 16.2.5 immediately.