#security

Deep Dive

Vercel rates GHSA-2464-fhr4-w9xw Critical, CVSS v4.0 9.5: an unauthenticated attacker can run code on a Next.js 10.0.0–15.5.27 or 16.0.0–16.4.0 server whose Image Optimization API processes SVG on glibc-based Linux. The bug is a use-after-free in librsvg (CVE-2026-96889), bundled in sharp's prebuilt binaries. Next.js 15.5.28 and 16.4.1 fix it on Node.js 20.9.0 or later by resolving sharp 0.35.5, which bundles the patched librsvg 2.63.2.

Deep Dive

GHSA-673q-mjm6-r5xr is rated Critical, CVSS v4.0 9.5, in the GitHub Advisory Database: an unauthenticated attacker can run code on a Next.js 16 server that uses App Router with Cache Components and has a use cache function returning multiple typed arrays. The database review classifies the flaw as deserialization of untrusted data (CWE-502) in the React Server Components transport protocol that Next.js bundles. Fixed in Next.js 16.4.1, with no workaround available.

Deep Dive

DOMPurify 3.4.4–3.4.16 lets split ${...} expressions survive SAFE_FOR_TEMPLATES inside attached shadow roots (Critical, CVSS v4.0 9.2). Upgrade to 3.4.17.

Security

Ostorlab vs MobSF (Mobile Security Framework) for mobile app security testing: static and dynamic analysis, device requirements, exploit proof, authenticated testing, integrations, deployment and cost, with alternatives and an FAQ.

Security

Ostorlab vs Oversecured for mobile app security testing: iOS and Android coverage, exploit proof, authenticated testing, APIs, integrations, deployment and pricing, with a side-by-side table, alternatives and an FAQ.

Product

The best Checkmarx alternatives and Snyk alternatives for SAST in 2026: how Ostorlab compares with Snyk Code, Checkmarx One and GitHub Advanced Security.

Product

How Ostorlab's Deep Agentic Scan uncovers and empirically proves complex vulnerabilities across web, mobile, and source code, in four real case studies.

Security

See how Ostorlab's Agentic Deep Scan chained a Medium-severity OpenAPI disclosure and an SSRF vulnerability to bypass a loopback restriction and extract database credentials.

Security

A technical deep-dive into how Ostorlab Neutron reached a 97.1% verified exploit solve rate (1,463/1,507 tasks) and localized the flaw in all 1,507 tasks on UC Berkeley's CyberGym benchmark, combining pure source reverse engineering with deterministic protocol modeling.

Security

Ostorlab Neutron reached a 97.1% verified exploit solve rate on CyberGym, producing working differential proofs of concept for 1,463 of the benchmark's 1,507 vulnerability reproduction tasks.