I put together a practical breakdown of how many users a small 1 vCPU + 2 GB RAM server can realistically handle. The answer isn’t simply “X users” because it depends heavily on the workload, application stack, caching, database usage, concurrent requests, and whether you’re serving static or dynamic content. For anyone running small self-hosted services or websites on inexpensive VPS instances, this may be useful

🚨 Critical Next.js RCE: malicious AVIF/HEIC images can trigger unauthenticated remote code execution through the Image Optimization API.

The attack chain involves Next.js → sharp → libvips → libheif, with a critical heap buffer overflow tracked as GHSA-g89c-p67h-r497.

Also patched: CVE-2026-75604, a separate critical Windows-hosted Next.js RCE.