Next team just published this: https://nextjs.org/blog/security-update-2025-12-11

Seems to affect 14.x, 15.x and 16.x.