Frameworks spend the week closing security holes

Nuxt patches eleven advisories in one release

Nuxt's week was dominated by a single, urgent release: an eight-advisory security patch in Nuxt itself that also pulls in three Nitro fixes via nitropack 2.13.6. The maintainers recommend upgrading as soon as possible, and most apps won't notice the accompanying behavior changes — but a few are worth knowing about. Server render failures in production now show only generic error details in the page and payload unless the error was created through createError, and the webpack and rspack dev servers reject unexpected Host headers unless they appear in devServer.allowedHosts. Cached route rules got narrower too: they only cache GET and HEAD requests and skip any response that sets cookies or sends Cache-Control: private or no-store. If you rely on route rules for anything with per-user data, audit those rules before deploying.

Next.js locks down its cache layer

Next.js spent the week on cache security, with one advisory set affecting both the current and LTS lines. The cache disclosure and poisoning fixes in the current release cover six moderate advisories: cross-tenant data leaking through use cache when called via unstable_cache, a follow-up cache leak across root param values in nested cached functions, cache poisoning of shared fallback shells in Cache Components, and response injection in self-hosted apps that forward fetched responses. The same release closes an SVG rejection bypass in image optimization and stops Edge runtime routes from exposing HttpOnly cookies through an internal response header. Teams on the older line get the equivalent injection, SVG, and cookie fixes backported to LTS, so there's no reason to stay exposed on either track.

Away from security, Next.js smoothed out a few Turbopack rough edges: missed startup CSS updates now trigger a reload and the PPR resume picks up the CSP nonce on the shared-runtime bootstrap, alongside a switch from jsonwebtoken to fast-jwt. Canary users, meanwhile, can now put a turbopackIgnore comment on new URL(), useful when a URL needs to survive bundling untouched.

SvelteKit hardens prerendering and server routing

SvelteKit's batch of patches reads like a prerendering audit. The core kit release returns a 400 instead of throwing when reroute rewrites a malformed pathname, escapes cache-control headers in prerendered HTML, and blocks path traversal when previewing prerendered pages on Windows, plus stops server-side route resolution from pulling code out of another origin. The downstream adapters inherited pieces of the same fixes: Cloudflare's adapter stops prerendered paths from creating stray _redirects and _routes.json rules, adapter-static escapes prerendered paths used in Vercel route patterns, and adapter-vercel does the same while accepting every Node.js version from 26 on rather than only even ones. Node users also got a targeted fix: adapter-node no longer crashes the server when an event-stream response has immutable headers.

Expo sharpens simulator workflows and capability sync

EAS CLI's week centered on making the warm iOS Simulator a real workflow primitive. New build steps let Appium sessions and agent-device runners share a warm Simulator or fall back to a cold start, and the launcher waits for a warm launcher that's already starting instead of racing it with a cold boot. On top of that, simulator control connections can now stay open with --keep-alive, be inspected or closed on demand, and be driven from imported action configurations. Secret handling got a useful hardening pass too: the worker now masks secrets in every record it writes to stdout, and iOS capability sync no longer loses already linked App Groups, Merchant IDs, or iCloud containers when new identifiers are linked.