This is what lands in your inbox.
One email when a threat affects you, with the verified fix. Reply to it like you would to a colleague; the watchdog reads every reply.
Affects you: Next.js image RCE, fixed in 15.5.28
Inbox
Hi Dana,
A critical bug in Next.js lets an attacker run code on your website through image uploads. Your site runs the affected version, so this one is yours.
Update Next.js to 15.5.28. Checked against the vendor’s own advisory: GHSA-2464-fhr4-w9xw.
Until then: keep SVG uploads off. That closes the path the attack uses.
Reply to this email to ask about it, or to tell me what changed in your stack.
InfraStack, your security watchdog
Updated, thanks. Two things changed since I signed up: we moved the site to Vercel and we added Stripe for payments. Lock file attached so you have the full list.
Got it. I’m now watching Vercel and Stripe alongside your site, plus the 212 packages in that lock file. Nothing new affects you today.
I checked the update too: 15.5.28 closes this one. You’re clear.
Quick one: Vercel had an outage yesterday afternoon and our site was down for a bit. Is that related to any of this?
No. That was a vendor incident, not an attack: Vercel’s edge network in iad1 degraded for 12 minutes from 2:06 PM, per their status page. Your site was unreachable for that window and came back on its own. Nothing to do on your side.
I watch their status page too; if an incident lasts past an hour or touches your region twice in a week, I’ll tell you.