Vercel next

• CVE-2026-94545 Medium 5.3 Satori-generated SVG has improper escaping 1.1%
• CVE-2025-59472 Medium 5.9 A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with th 0.4%
• CVE-2025-59471 Medium 5.9 A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads exter 0.5%