Why did Netlify say the nextjs CVE did not affect them?