Only if you are running a vulnerable version of Next.js server.

No, unless you run the React Server Component runtime on your server, which you wouldn't do with a SPA, you would just serve a static bundle.