Next.js 16.3.6 fixes critical ImageResponse RCE (CVE-2026-94545) | Dark Hacker News