I suspect these CVEs will be 100% ignored irrespective of their severity. I wrote JavaScript for employment for over 15 years.

Frameworks only exist for the employer to supplement hiring and for those developers that are reliant upon them their availability is the only thing that matters.

12 total for Next.js

Here's the 1 for React: https://github.com/facebook/react/security/advisories/GHSA-r...