[robertoandred]

That was a React vulnerability, not a Next one.

[shimman]

It was a vulnerability that only could exist due to the incestuous relationship between React and Vercel. It was something Vercel has been trying to heavily push into React for years (which is why they hired previous react core team members).