| RoamingPigs |
18 October 2026 |
|
|
|
|
|
|
Two days after a Critical Next.js RCE shipped, npm audit still called the affected version clean.
|
|
|
|
The short version
npm audit on next@16.4.0 printed 0 vulnerabilities and exited 0 two days after two Critical RCEs named that version; 16.3.5 failed with 7. The npm feed, GitHub's database and OSV all lacked the new advisories. For a Critical, read the range on the vendor's own advisory and compare your version yourself.
| |
|
A clean audit says the database had no matching entry. It does not say your version is safe. Those are different sentences.
|
|
Read the essay →
|
Also worth your time |
|
Nobody Stole the Keys
Bitget's forensic reports describe a tool that filled in its own risk checks. The first fix I tried broke.
▪ CRYPTO · 16 MIN
|
|
Your Dashboard Shows a Request Nobody Makes
A per-service p99 describes one backend. A request that fans out to a hundred of them meets the slowest of the hundred.
▪ CONTRARIAN · 12 MIN
|
|
Read the Reconciliation, Not the Metric
A $1.37 billion half-year loss became a $141.8 million margin in one S-1 table. How to read any such bridge.
▪ STARTUP ADVISORY · 12 MIN
|
|
Hit reply if you want to argue with any of it. It reaches me, not a queue, and I answer.
Cisco
|
| |
|
Unsubscribe in one click · Read it on the web You confirmed this subscription at roamingpigs.com.
RoamingPigs, Inc. · c/o Cisco Caceres, 200 W Sahara Ave, Las Vegas NV 89102
|