Next.js patched 13 CVEs in one afternoon. The pattern matters more than the count.6 min readVercel shipped 13 advisories on May 7 — DoS, SSRF, cache poisoning, auth bypass, XSS. The pattern reframes RSC as a public API.13 May 2026·6 min read