(BUSAN.SASHIMI)
Weekly Digest // JS_FRAMEWORKS — Week 35-2026
codeWeekly Report

Next.js Ships Two Critical RCE Fixes — Week 35 JavaScript

Next.js security patches, Node.js 24.20 permissions, and Rspack 2.2 performance changes make execution boundaries the JavaScript story of Week 35.

calendar_todaysummarizeWeek 35-2026bolt1 CRITICAL
TAG: SECURITY RELEASEREAD_TIME: 2_MIN

August 2026 Security Release

Next.js 16.3.3 and 15.5.24 fix two critical unauthenticated remote-code-execution paths. One is triggered when the Image Optimization API processes an attacker-controlled AVIF through libheif; the releases disable AVIF optimization while an upstream fix propagates. The other affects Windows servers using both the Pages Router and App Router without Cache Components. Linux and macOS are unaffected by that path, but affected Windows deployments have no workaround. Teams should patch rather than attempt configuration-only mitigation.

Read Articlearrow_forward
TAG: LTS RELEASEREAD_TIME: 20_MIN

Node.js 24.20.0 (LTS)

Node.js 24.20.0 LTS makes runtime authority more observable and revocable. permission.drop permanently removes granted access, while --permission-audit reports denied operations without throwing so teams can discover requirements before enforcement. The release also adds package maps for loaders, node:stream/iter, structured test logging, an end bound for Buffer searches, and JavaScript Promise Integration for WebAssembly. The long changelog includes dependency, crypto, stream, QUIC, and memory fixes, so production adoption still needs workload-specific regression testing.

TAG: BUILD TOOLREAD_TIME: 7_MIN

Announcing Rspack 2.2

Rspack 2.2 collects more than 30 performance changes: its benchmark cuts production build time from 1,822 ms to 1,725 ms, makes CopyRspackPlugin about 3–4 times faster, triples built-in CSS parsing, and reduces one Wasm plugin's load time by about 80%. The ecosystem release adds Baseline Browserslist queries, compact stable IDs, Module Federation testing, Playwright integration, and more than 500 Rslint rules. Upgraders must rebuild SWC Wasm plugins for swc_core 77 and review the breaking RSC CSS-loading change.

summarizeDigest_Summary

Next.js moved its August security release forward after finding a second critical vulnerability. Versions 16.3.3 and 15.5.24 address unauthenticated remote code execution through attacker-controlled AVIF optimization and a separate Windows-hosted server path. AVIF optimization is disabled until the upstream library is fixed, while affected Windows deployments have no workaround beyond patching.

Node.js 24.20.0 LTS expands the runtime's own policy surface. permission.drop can permanently surrender authority, --permission-audit records denied operations without throwing, and the release also adds package maps, iterable streams, test logging, and WebAssembly JSPI. The direction is toward making authority and asynchronous work visible in core APIs.

Rspack 2.2 applies more than 30 performance optimizations and reports production builds falling about 5%, CopyRspackPlugin running 3–4 times faster, CSS parsing tripling, and one Wasm plugin loading about 80% faster. Its breaking SWC Wasm boundary and RSC integration change are reminders that speedups still arrive with explicit compatibility contracts.

Key Takeaways
  • Patch Next.js to 16.3.3 or 15.5.24 immediately; Windows servers using both routers without Cache Components cannot mitigate the RCE without upgrading.
  • Use Node.js permission audit mode to observe required access before dropping permissions permanently, and test experimental stream and Wasm APIs behind clear rollout boundaries.
  • Benchmark Rspack 2.2 on production-shaped projects, then rebuild SWC Wasm plugins against swc_core 77 and review RSC CSS loading before upgrading framework integrations.