- Fixed moderate cross-client response injection and disclosure in self‑hosted Next.js apps forwarding fetched responses.
- Patched SVG rejection bypass in Next.js image optimization.
- Resolved HttpOnly cookie exposure via internal response headers on Edge runtime routes.