Thank you. This is the part that shocks me the most. I was always wary of Next.js for this exact reason (in fact, I refused to use it for personal projects before the RCE because I was scared that I would make a mistake and leak server-side data to the client.

Bugs like this are easy to happen and even easier to miss if you’re generating thousands of lines of code with AI.

That was a React vulnerability, not a Next one.