This looks to be the same as the React RCE (https://news.ycombinator.com/item?id=46136026) but presumably it was NextJS's fault all along.