--- collection: frontend-frameworks collection_name: Frontend Frameworks week_start: 2026-10-12 title: Next.js races to patch critical RCEs as Expo SDK 58 arrives release_count: 16 generated: 2026-10-19 canonical: https://releases.sh/collections/frontend-frameworks/digest/2026-10-12 --- # Next.js races to patch critical RCEs as Expo SDK 58 arrives Next.js shipped emergency patches for two critical unauthenticated remote code execution flaws, while Expo released SDK 58 with day-one iOS 27 support, App Intents, and React Native 0.88. ### Security first: Next.js RCE patches The week's most urgent news came from Next.js, which patched two critical unauthenticated remote code execution vulnerabilities — one in `use cache` functions returning typed arrays, and one in the Image Optimization API when SVG files are used — alongside a high-severity denial of service in the App Router using Server Actions. The [16.x line got the full set of fixes](https://github.com/vercel/next.js/releases/tag/v16.4.1), while the [15.5 line received the Image Optimization RCE and the Server Actions DoS backport](https://github.com/vercel/next.js/releases/tag/v15.5.28), so apps pinned to the older major can close the more broadly reachable hole without a major upgrade. Anyone accepting user-supplied SVGs through `next/image` should treat this as a drop-everything upgrade; the advisories carry the full detail. Next.js also kept its quieter channels moving. The LTS branch picked up [Turbopack dev module graph chaining for the Pages Router plus a batch of snapshot-consistency fixes](https://github.com/vercel/next.js/releases/tag/v16.4.2), tidying lazy dynamic-import chunk collisions and module-resolution realpath errors along the way. And on canary, [Turbo-persistence began prefetching multi-page SST blocks with MADV_WILLNEED](https://github.com/vercel/next.js/releases/tag/v16.5.0-canary.17) — plumbing work that hints at faster incremental builds ahead. ### Expo SDK 58 lands with iOS 27 and Apple Intelligence Expo's headline release is [SDK 58, built for iOS 27 and React Native 0.88](https://expo.dev/changelog/sdk-58). Because iOS 27 requires the UIKit scene-based life cycle and makes iPhone apps resizable, this is a compatibility milestone as much as a feature drop. The alpha `expo-app-intents` package exposes app actions to Siri, Shortcuts, Spotlight, and Apple Intelligence; `expo-hinge` reports foldable hinge state; and `expo-device-hub` streams simulators into the browser. Alongside it, [expo.dev settings got a redesign around dedicated pages and a consistent sidebar](https://expo.dev/changelog/settings-navigation-refresh), with billing, access tokens, credentials, and hosting reorganized into their proper scopes. ### EAS CLI: simulator control for agents EAS CLI spent the week building out remote-simulator workflows aimed squarely at coding agents. The release train added [an `eas simulator:control` command that runs serve-sim actions like file upload and download on a remote iOS simulator](https://github.com/expo/eas-cli/releases/tag/v25.2.0), a headline change that also defaulted new simulator sessions to [authenticated preview links, with public sharing opt-in via `--public-link`](https://github.com/expo/eas-cli/releases/tag/v25.0.0), and started `expo-device-hub` for Android sessions. Agent tooling deepened with [the `eas/run_agent` build step that runs Claude Code or Codex against the Expo MCP server](https://github.com/expo/eas-cli/releases/tag/v24.13.0) — which also deprecated Node.js 20 for a future Node 22 requirement — and [device run session jobs now call www only through the worker API](https://github.com/expo/eas-cli/releases/tag/v25.1.1) after dropping their GraphQL fallbacks. Maestro users got [a `--platform` flag for per-platform run and flow insights](https://github.com/expo/eas-cli/releases/tag/v24.14.0). ### SvelteKit hardens CSP, Nuxt cleans up routing SvelteKit's batch leaned toward server-side correctness: [the kit added CSP `report-sha256`/`384`/`512` reporting keywords and an endpoint span for tracing](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.0), with a fix for projects nested in a `server` directory wrongly treating every module as server-only. Its package tooling now [emits component types for the installed Svelte version](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/package%403.0.1), and the adapters got platform fixes — [Bun minor versions preserved in the Vercel runtime](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-vercel%407.0.1) and [Concurrent dev servers, Deno global quirks, and local `tracing` emulation fixed on Cloudflare](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-cloudflare%408.0.1). Nuxt's patch closed [a `useHeadSafe` gap on server island head and made server route rules match case-insensitively](https://github.com/nuxt/nuxt/releases/tag/v4.6.2). ## Releases covered ### Expo - [Expo SDK 58 ships iOS 27 support with React Native 0.88 and App Intents](https://expo.dev/changelog/sdk-58) - [Expo refreshes expo.dev settings navigation with dedicated sidebar pages](https://expo.dev/changelog/settings-navigation-refresh) - [EAS CLI v25.2.0 adds eas simulator:control for remote iOS simulator sessions](https://github.com/expo/eas-cli/releases/tag/v25.2.0) - [EAS CLI v25.0.0 defaults simulator sessions to authenticated preview links](https://github.com/expo/eas-cli/releases/tag/v25.0.0) - [EAS CLI v24.13.0 deprecates Node.js 20 and adds eas/run_agent step](https://github.com/expo/eas-cli/releases/tag/v24.13.0) - [EAS CLI v25.1.1 routes device run session jobs through worker API only](https://github.com/expo/eas-cli/releases/tag/v25.1.1) - [EAS CLI v24.14.0 adds --platform to Maestro workflow insights](https://github.com/expo/eas-cli/releases/tag/v24.14.0) ### Nuxt - [Nuxt v4.6.2 fixes server island head sanitization and route rule matching](https://github.com/nuxt/nuxt/releases/tag/v4.6.2) ### Svelte - [@sveltejs/kit@3.1.0](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.0) - [@sveltejs/package@3.0.1](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/package%403.0.1) - [@sveltejs/adapter-vercel@7.0.1](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-vercel%407.0.1) - [@sveltejs/adapter-cloudflare@8.0.1](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-cloudflare%408.0.1) ### Vercel - [Next.js v16.4.1 patches two critical unauthenticated RCE vulnerabilities](https://github.com/vercel/next.js/releases/tag/v16.4.1) - [Next.js v15.5.28 patches critical RCE in Image Optimization API](https://github.com/vercel/next.js/releases/tag/v15.5.28) - [Next.js v16.4.2 backports Turbopack dev module graph chaining to Pages Router](https://github.com/vercel/next.js/releases/tag/v16.4.2) - [Next.js v16.5.0-canary.17 prefetches multi-page SST blocks with MADV_WILLNEED](https://github.com/vercel/next.js/releases/tag/v16.5.0-canary.17)