security

Next.js patched 13 CVEs in one afternoon. The pattern matters more than the count.

Vercel shipped 13 advisories on May 7 — DoS, SSRF, cache poisoning, auth bypass, XSS. The pattern reframes RSC as a public API.