Multiple Critical Vulnerabilities Patched in Next.js and React Server Components

**Executive summary:** Vercel released security advisories for Next.js and React Server Components detailing multiple vulnerabilities across versions (13.x–16.x for Next.js and 19.x for RSC), including high-severity denial-of-service via the React Flight deserialization, SSRF through WebSocket upgrade handling, middleware and i18n middleware bypasses that allow unauthorized access to protected content, plus several XSS and cache-poisoning issues; organizations should prioritize upgrading and apply interim mitigations (route-level authorization, blocking WebSocket upgrades, and restricting egress).