Turborepo 2.9.14 patches VS Code extension command injection. Vercel shipped Turborepo v2.9.14 today. Under the CI and docs churn sits a blunt security note worth catching even if your monorepo never touches turbo on the CLI: the VS Code Turborepo / LSP extension carries fixes for multiple advisories, and the headline item is GHSA-5xc8-49mv-x4mm (CVE-2026-46508, rated High). Where the hole actually lived. Upstream's wording is sober. Older extension builds routed some daemon and task-runner work through string-shaped shell commands. Values that a repo can steer (workspace configuration, names of tasks surfaced from the codebase) fed into those strings. Activate the extension against a hostile clone, or run a task through the extension UI after those values loaded, and the host shell could interpret the payload as arbitrary commands running with whatever rights the VS Code process already has. This is classic "IDE extension meets untrusted workspace" territory. The precondition is simpler than chasing a zero-day broker: convincing someone to open your repo locally plus enough interaction that the extension does its job. What changed in practical terms. GitHub lists the patched band as >= 2.9.14000 for the Turborepo LSP package and summarizes the remediation as ditching brittle shell interpolation (execFile with explicit argv for daemon hooks, structured terminal launches for tasks), marking Turborepo executable knobs so machines, not workspaces, decide where binaries live, and shutting the extension down inside VS Code's untrusted-workspace mode until the user explicitly trusts the folder. If you cannot update yet, the advisory's fallback is also simple: do not run the extension against repositories you do not trust, and avoid driving Turborepo tasks from the extension until you are on a fixed build. The rest of the tag (fast). The same release line also documents two Low issues: a login-callback hardening pass (GHSA-hcf7-66rw-9f5r) and a cleanup so Yarn Berry detection does not execute surprise project-local binaries (GHSA-3qcw-2rhx-2726). Worth skimming if you manage developer laptops, but the extension command path is the one that should interrupt dinner. What to do on a team laptop. * Update the Turborepo VS Code extension to the build that ships with 2.9.14 (or newer once it exists), then verify the Marketplace / Open VSX sidebar shows that version lineage. * If you automate editor rollouts through an internal marketplace mirror, bake the patched extension artifact into whatever approval queue you already use for Chromium or Docker Desktop updates. Malicious repo input that reaches a shell inside VS Code predates Turborepo; this extension is catching up to the execution style hardened tools adopted after earlier wake-up calls in the same class of bug.

Next.js just patched 13 security advisories. Self-hosted teams have the most work. May 10, 2026 On May 7, Vercel shipped a coordinated security release covering 13 advisories across Next.js and React Server Components. The bundle includes high-severity issues for denial-of-service, server-side request forgery, cache poisoning, and several middleware-bypass flaws affecting App Router. If your team runs self-hosted Next.js on Node, you have the most ground to cover. The fixes land in 15.5.18 and 16.2.6. React users on react-server-dom should jump to 19.0.6, 19.1.7, or 19.2.6 depending on the line they track. Versions 13.x and 14.x are not getting patches at all, so anyone still on those needs to plan an upgrade rather than wait for a cherry-pick. What's actually in the bundle. The headline CVE most outlets are quoting is CVE-2026-23870, a high-severity DoS in the React Flight protocol deserialization. A specially crafted HTTP request to any App Router server function can pin a CPU core. Bad, but a known shape of bug, the kind a WAF or rate limiter can blunt. The class worth reading more carefully is the middleware-bypass set. The advisories describe variants where .rsc and segment-prefetch URLs resolve to the same page as a normal request, but skip the middleware matcher rules. Translation: if your middleware.ts is the only thing between an unauthenticated request and a protected page, an attacker can ask for the same content via a different transport and walk in. There's a related Pages Router variant tied to i18n locale handling, plus a follow-up advisory for the Turbopack code path because the original fix didn't cover it. The remaining advisories cover SSRF via WebSocket upgrade requests on self-hosted Node (Vercel-hosted apps are not affected), DoS in the Image Optimization API, XSS, and cache poisoning of RSC responses. Why "middleware as auth" keeps biting teams. In its pentesting engagements, this is one of the patterns Itguys Systems Srl test for first when Itguys Systems Srl see Next.js in scope. The shape repeats: a single middleware.ts checks the session cookie, redirects to login if missing, and the team treats every route below it as protected. It feels clean. It reads well in PRs. And it usually has a transport-variant gap that someone will eventually find. Middleware in Next.js is a routing concern. It runs early, has limited APIs, and has historically had quirks around how matchers apply to internal request shapes (RSC payloads, prefetches, dynamic segments, locale-prefixed paths). Each of those quirks has surfaced as a CVE class at some point. This week's batch is the latest reminder. When Itguys Systems Srl build cloud-native apps with App Router, Itguys Systems Srl treat middleware as a fast-path filter and put real authorization checks in the route handler, the server action, or the server component itself. The cookie value becomes the input, not the verdict. That extra check costs almost nothing and removes a whole family of bypass risk. What to do this week. A short list: * Upgrade next to 15.5.18 or 16.2.6. If you publish on Pages Router with i18n through the OpenNext adapter, also bump it to 5.15.11. * If you depend on react-server-dom-* directly, match the 19.x patch line you're on (19.0.6, 19.1.7, or 19.2.6). * Plan the move off 13.x or 14.x. Those branches will not get these fixes. * Audit your middleware.ts. If a route is protected only by middleware, add a server-side auth check inside the route handler, server action, or layout. Do not skip this just because you upgraded. * For self-hosted Node deployments, look at edge or proxy logs for unusual .rsc requests, WebSocket upgrades to unexpected origins, and Image Optimization traffic spikes. The SSRF and DoS issues will show up in self-hosted environments first. A note on self-hosted vs platform. Several of these issues are explicitly scoped to self-hosted Node. Vercel says hosted projects had WAF rules in front of the patch. Netlify says some of the advisories don't apply to their serverless model at all. That gap is worth thinking about when you decide where to run Next.js. From its cloud-native development work, Itguys Systems Srl has seen plenty of teams pick self-hosting for cost or compliance reasons (Swiss enterprise clients especially), and that's a fine call. But you carry more of the responsibility for runtime security yourself, and patch cadence becomes part of the operating budget, not a quarterly afterthought. If keeping a self-hosted Next.js stack hardened and patched on a real schedule sounds familiar, let's talk. Itguys Systems Srl do this work across web and mobile builds and security reviews, and the answer is rarely "more middleware". expert-analysis nextjs security tech-news vulnerability web-development

FAQ: Vercel vs Netlify 2026. Is Vercel cheaper than Netlify in 2026? It depends on the workload. Vercel charges $20 per developer seat plus $0.15/GB bandwidth overage; Netlify charges $20 flat for unlimited seats plus roughly $0.55/GB bandwidth overage. For a 10-person team with 200 GB monthly bandwidth, Netlify is roughly 5x cheaper. For a 3-person team with 2 TB monthly bandwidth, Vercel is roughly 3x cheaper. Run your real numbers through both pricing pages. Can I host a commercial site for free on Vercel? No. Vercel's Hobby plan terms explicitly prohibit commercial use, including ads, affiliate links, lead generation, and SaaS subscriptions. To run a revenue-generating site on Vercel you must upgrade to Pro at $20/month per seat. Netlify Starter explicitly allows commercial use within its bandwidth and credit quotas. Does Netlify support Next.js as well as Vercel does? Almost. The Netlify Next.js Runtime adapter ships feature parity for most App Router APIs, but lags by one to two release cycles on bleeding-edge features. ISR, Server Actions, Server Components, and the App Router all work on Netlify; the new use cache directive and certain Vercel-specific Image Optimization paths require workarounds. For production Next.js apps that follow the framework's mainstream feature set, Netlify is fully production-ready. What is Vercel Fluid Compute and why does it matter? Fluid Compute, launched by Vercel in late 2025, lets a single serverless function instance handle multiple concurrent requests rather than spinning up a fresh instance per request. The result is dramatically lower cold-start frequency, lower per-request cost in steady state, and better behavior for AI-streaming workloads where the function holds open a connection for many seconds. Netlify does not ship an exact equivalent as of April 2026. Which platform is better for AI applications? Vercel, by a wide margin in April 2026. The Vercel AI SDK (around 2 million weekly downloads), v0 generative-UI, Vercel Agent, Edge Functions for streaming, and Vercel Postgres / KV combine into the deepest AI-native stack on any PaaS. Netlify Composer is a strong option for content-driven AI workflows, but it does not match the integration depth or product breadth. How long does a typical migration between the two platforms take? Static sites: under an hour for most projects. Server-rendered Next.js apps: one to two days, primarily for Vercel-specific API rewrites. Function-heavy SaaS apps: three to seven days, depending on how many proprietary services (Vercel KV, Netlify Forms, Netlify Identity) need replacement. Plan a low-traffic deploy window for DNS cutover and keep the previous platform live as a hot rollback for at least 48 hours. Are Vercel and Netlify SOC 2 and HIPAA compliant? Both ship SOC 2 Type II reports on standard tiers and HIPAA-eligible Enterprise tiers. Netlify has a longer track record with regulated-industry deployments (healthcare, finance), while Vercel has caught up rapidly with marquee enterprise logos like PayPal, Walmart, and Nike during 2024-2025. For procurement that requires extensive compliance documentation, request the trust packets from both vendors before deciding. Should I consider cloudflare pages or AWS Amplify instead? Yes, depending on your priorities. Cloudflare Pages + Workers is meaningfully cheaper at high volumes (Cloudflare's bandwidth is effectively unmetered) but ships less polished Next.js support. AWS Amplify is the right choice if your team already runs heavily on AWS and wants tight IAM/CloudWatch integration but expect more configuration overhead. Vercel and Netlify are the right defaults for teams that want a polished PaaS without managing the underlying primitives. Sources and external references: Vercel Pricing, Netlify Pricing, Next.js documentation, Next.js on GitHub, and Stack Overflow Developer Survey 2025. Pricing data verified against vendor pages on April 5, 2026. AI & Innovation Editor Nadia Dubois is the AI & Innovation Editor at Tech Insider, where she tracks the rapid evolution of artificial intelligence, from foundation models to real-world enterprise deployment. She previously covered AI and startups for La Tribune and contributed to MIT Technology Review's European coverage. Nadia specializes in generative AI, AI regulation, and the intersection of technology and European industrial policy. She holds a dual degree in Computational Linguistics and Journalism from Sciences Po Paris.