Critical Next.js RCE patches land as Vercel opens its agent stack

Next.js RCE patches, and the WAF rules that raced them

The week's most urgent story was a pair of critical unauthenticated remote code execution vulnerabilities in Next.js: one affecting Windows-hosted servers and one reachable through the Image Optimization API when crafted AVIF files are processed. Vercel patched both branches at once, with the 16.x line and the 15.x line each receiving the same two advisory fixes — if you run either major version in production, upgrade now rather than waiting for a routine window.

Cloudflare's WAF moved in parallel. An emergency rules update extended an existing Next.js RCE rule to identify CVE-2026-75604 across Windows-hosted Pages Router and App Router apps, and added fresh detection for the AVIF Image Optimizer path. The same week brought four detections promoted from Log to Block, including HTTP/2 request smuggling and XSS JavaScript event handler coercion across headers, body, and URI, plus a new generic remote code execution rule in Block mode. Together that's a meaningful tightening of default protections for anyone behind the managed ruleset.

Next.js also continued its v17 groundwork, with Cache Components arriving in create-next-app and Pages Router deprecating React 18, alongside Turbopack tweaks to CSS module class naming and request-context retention.

Vercel opens up agent infrastructure

Vercel's bigger product story was Vercel Connect reaching general availability, giving agents and apps a supported secure connectivity layer instead of bespoke plumbing. It pairs naturally with building eve agents straight from the dashboard, which scaffolds agent code, pushes it to your repo, and creates a project wired up with AI Gateway models, web chat or Slack, and MCP connections — a notable shortcut from idea to running agent.

The AI Gateway itself got steadier in production terms: per-user spending caps join the existing team, project, and API key budgets, while Tencent's Hy4 Preview and Meta's Muse Image both became callable with a single key, no provider account required. On the SDK side, the harness layer picked up an fx adapter that runs through the existing HarnessAgent interface.

Performance monitoring got cheaper for everyone: Speed Insights introduced a free tier covering real-user data on every plan, with paid capabilities continuing as Speed Insights Plus.

The AI SDK shipped a run of provider work — a new Z.AI provider for GLM chat completions with streaming, reasoning, tools, and multimodal inputs; Moonshot's predicted output and partial mode support; Google safety-block metadata surfaced as content-filter results; and stricter tool-choice enforcement in generateText, which now rejects responses that violate a required tool selection and exposes the content for recovery.

GLM-5.3 lands across Workers AI

Cloudflare's model catalog absorbed Z.ai's latest in a hurry. GLM-5.3, the flagship agentic coding model, arrived at GLM-5.2 pricing while roughly doubling long-horizon benchmark scores, and GLM-5.3 Flash followed as the first natively multimodal entry in the GLM-5 series, beating its predecessor at a lower price. Both are reachable by binding, REST API, OpenAI-compatible endpoint, or AI Gateway.

AI Search wasted no time adopting them, adding GLM-5.3 Flash for text generation with its million-token context window and six more Workers AI models including DeepSeek V4 Flash and Pro, GPT-OSS 120b and 20b, Qwen3.8-27b, and Kimi K2.7 Code — all without a separate provider key.

Load balancing, local dev, and platform housekeeping

Cloudflare Load Balancing gained pool sets, letting a single load balancer apply different candidate pools, steering policies, weights, and fallbacks per data center, country, or region — geographic matching that previously took multiple load balancers. Elsewhere on the edge, Durable Objects raised their concurrent Dynamic Worker ceiling to ten, and APO resumed caching crawler and bot HTML requests after an Accept-header regression, so any Transform Rule workaround you added can go.

The Workers toolchain had a busy, mostly structural week: shared local storage across Miniflare instances, email inspection and local Images binding support, PR metadata attached to preview deployments, per-workflow default retention in wrangler, and Vitest support for Workerd's new module registry. Several config packages converged on a worker field name and input/output schema conventions (config v0.9.0, Config 0.8.0, build-output-utils), and the runtime fixed node:fs cp symlink handling.

Smaller but worth noting: app-scoped API tokens for Flagship and scannable cfast_ service token secrets tighten credential hygiene, Log Explorer gained permanent dataset deletion with protection on by default, and the Azure Functions Sentinel connector's retirement date is now firm — enterprise users should migrate before September 14. Railway's CLI reworked its MCP proxy command and added a threads TUI, Railpack moved pnpm provisioning to Mise with devEngines taking precedence, and Turborepo streamed dry-run JSON output while merging same-prefix globs into single directory walks.