Multiple CVEs were disclosed in Next.js today, sending shockwaves through a community that has essentially been in permanent shock since version 13. The vulnerabilities, which involve more CVEs than anyone can count, affect versions ranging from "yes" to "also yes."

"I just deployed to prod three hours ago," whispered one developer from Ohio Rizz Village, visibly shaking. "I didn't even know what a CVE was before today. Now it's my entire personality." Another developer from Sigma Pur was seen updating his resume with "Next.js vulnerability mitigation specialist" — a title he awarded himself during the 47 seconds between reading the advisory and his Slack going offline.

The React community's response has been characteristically measured and calm, by which we mean 4,000 people are currently arguing on Twitter dot com about whether this proves you should use Remix, Astro, or just raw HTML like it's 1997.

grossHopper's official tech advisory reads: "Delete Next.js. Delete React. Delete your debt. Just use HTML and CSS. Sometimes the simplest solution is to go static and crawl between the cracks of the internet. We've been doing it since forever."