We scan the JavaScript ecosystem so you don't have to. JS Signal filters out the noise, explains what matters, and gives you the context to understand what changed and why it matters.

Two Critical Next.js RCEs Are Patched — Here's How to Check If You're Affected

The August 2026 security release fixed two unauthenticated remote code execution bugs: one in AVIF image optimization (CVSS v4 9.5), one a Windows-specific path traversal (CVSS v4 9.0). Minimum fix is 15.5.24 or 16.3.3.