Next.js out-of-band patch fixes two critical unauthenticated RCEs
Both score 9.5 and need no login, with a Server Actions DoS riding along. Also today: Grok Voice 3.0 tops the voice index and Pi opens its robot-model API.
Copy markdown
Two unauthenticated RCEs, both rated 9.5
The Oct 14 out-of-band release fixes a `use cache` typed-array RCE (GHSA-673q-mjm6-r5xr) in App Router apps with Cache Components, and an SVG-image RCE (CVE-2026-96889) through sharp/librsvg. Vercel scores both 9.5. Upgrade to 16.4.1 (Active LTS) or 15.5.28 (Maintenance LTS) now.
A Server Actions DoS rides along
The same patch closes GHSA-p3m5-59mp-jv5r (High): any App Router app with at least one Server Action can be pinned at 100% CPU on a single process by crafted requests, starving other traffic. Pages Router and Server-Action-free apps are safe. There is no workaround — only the upgrade.
Your npm audit may still read clean
As of Oct 15 the use cache and DoS advisories were not in the npm feed, so a scan can pass while you are exposed. Only the SVG bug has a stopgap: run sharp 0.35.5+ (v15 still accepts the vulnerable 0.34.x) or sharp.block({ operation: ['VipsForeignLoadSvg'] }). The other two need the version bump.
Grok Voice 3.0 hits the Voice Agent API
xAI's new speech-to-speech model (Oct 14) runs at $0.08/min with first audio under a second, and grok-voice-latest callers were migrated automatically. It leads Artificial Analysis's Speech-to-Speech Index at 86.9 (GPT-Live-1: 83.2) at about $0.025 per Big Bench Audio task, though it trails GPT-Live-1 on τ-Voice support calls.
Physical Intelligence opens its robot-model API
The Pi API beta lets outside teams upload teleop demos, fine-tune a robot foundation model on Pi's compute, and serve it through a hosted inference gateway — swapping in newer models without retraining. π0 and π0.5 stay open in the openpi repo; access is waitlisted and pricing is not public yet.
Two more models go free on Vercel's AI Gateway
Nvidia's Nemotron 3.5 Lightning is now free through Vercel AI Gateway — one key, no separate provider account, with spend tracking and traces — and Fish Audio's Drama 3 expressive-speech model landed a day earlier. An easy way to try both with no new signups.