Critical vulnerability in Next.js allows 'unauthenticated takeover'. Two weeks since the patch, potential PoC code has emerged, so if you haven't already, update to 16.4.1/…

Next.js released an emergency security update on October 14. Two of the issues are 'Critical' and could allow code execution ...
The Hacker News

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js patches two critical RCE flaws involving typed arrays and SVG processing, plus a Server Actions DoS affecting App Router apps.

I implemented security measures under the assumption that more serious problems than PHP or Node.js are coming

In October, a critical vulnerability in PHP and multiple vulnerabilities in Node.js were announced around the same time.