Update dependency next to v16.1.7 [SECURITY]#40
Open
renovate[bot] wants to merge 1 commit intotrunkfrom
Open
Conversation
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the
Comment |
✅ Deploy Preview for winpax-website ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-next-vulnerability
branch
2 times, most recently
from
721cbb6 to
54de4de
Compare
renovate
bot
force-pushed
the
renovate/npm-next-vulnerability
branch
from
54de4de to
99fcaa5
Compare
renovate
bot
changed the title
✅ Deploy Preview for winpax-website ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
renovate
bot
force-pushed
the
renovate/npm-next-vulnerability
branch
from
99fcaa5 to
88df464
Compare
renovate
bot
changed the title
✅ Deploy Preview for winpax-website ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
16.0.7→16.1.7GitHub Vulnerability Alerts
GHSA-w37m-7fhw-fmv9
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55183.
A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Functions. This could reveal business logic, but would not expose secrets unless they were hardcoded directly into Server Function code.
GHSA-mwv6-3258-q52c
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55184.
A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.
CVE-2025-59471
A DoS vulnerability exists in self-hosted Next.js applications that have
remotePatternsconfigured for the Image Optimizer. The image optimization endpoint (/_next/image) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires thatremotePatternsis configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.Strongly consider upgrading to 15.5.10 and 16.1.5 to reduce risk and prevent availability issues in Next applications.
GHSA-h25m-26qc-wcjf
A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.
CVE-2025-59472
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the
Next-Resume: 1header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:Unbounded request body buffering: The server buffers the entire POST request body into memory using
Buffer.concat()without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.Unbounded decompression (zipbomb): The resume data cache is decompressed using
inflateSync()without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.Both attack vectors result in a fatal V8 out-of-memory error (
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.To be affected, an application must run with
experimental.ppr: trueorcacheComponents: trueconfigured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
CVE-2026-27978
Summary
origin: nullwas treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests.Impact
An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF).
Patches
Fixed by treating
'null'as an explicit origin value and enforcing host/origin checks unless'null'is explicitly allowlisted inexperimental.serverActions.allowedOrigins.Workarounds
If upgrade is not immediately possible:
SameSite=Stricton sensitive auth cookies.'null'inserverActions.allowedOriginsunless intentionally required and additionally protected.CVE-2026-27977
Summary
In
next dev, cross-site protections for internal development endpoints could treatOrigin: nullas a bypass case even whenallowedDevOriginsis configured. This could allow privacy-sensitive or opaque browser contexts, such as sandboxed documents, to access privileged internal dev-server functionality unexpectedly.Impact
If a developer visits attacker-controlled content while running an affected
next devserver withallowedDevOriginsconfigured, attacker-controlled browser code may be able to connect to internal development endpoints and interact with sensitive dev-server functionality that should have remained blocked.This issue affects development mode only. It does not affect
next start, and it does not expose internal debugging functionality to the network by default.Patches
Fixed by validating
Origin: nullthrough the same cross-site origin-allowance checks used for other origins on internal development endpoints.Workarounds
If upgrade is not immediately possible:
next devto untrusted networks.allowedDevOrigins, reject requests and websocket upgrades withOrigin: nullfor internal dev endpoints at your proxy.CVE-2026-27979
Summary
A request containing the
next-resume: 1header (corresponding with a PPR resume request) would buffer request bodies without consistently enforcingmaxPostponedStateSizein certain setups. The previous mitigation protected minimal-mode deployments, but equivalent non-minimal deployments remained vulnerable to the same unbounded postponed resume-body buffering behavior.Impact
In applications using the App Router with Partial Prerendering capability enabled (via
experimental.pprorcacheComponents), an attacker could send oversizednext-resumePOST payloads that were buffered without consistent size enforcement in non-minimal deployments, causing excessive memory usage and potential denial of service.Patches
Fixed by enforcing size limits across all postponed-body buffering paths and erroring when limits are exceeded.
Workarounds
If upgrade is not immediately possible:
next-resumeheader, as this is never valid to be sent from an untrusted client.CVE-2026-29057
Summary
When Next.js rewrites proxy traffic to an external backend, a crafted
DELETE/OPTIONSrequest usingTransfer-Encoding: chunkedcould trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.
Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so
content-length: 0is added only when bothcontent-lengthandtransfer-encodingare absent, andtransfer-encodingis no longer removed in that code path.Workarounds
If upgrade is not immediately possible:
DELETE/OPTIONSrequests on rewritten routes at your edge/proxy.CVE-2026-27980
Summary
The default Next.js image optimization disk cache (
/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.
Patches
Fixed by adding an LRU-backed disk cache with
images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. SettingmaximumDiskCacheSize: 0disables disk caching.Workarounds
If upgrade is not immediately possible:
.next/cache/images.images.localPatterns,images.remotePatterns, andimages.qualities)Release Notes
vercel/next.js (next)
v16.1.7Compare Source
v16.1.6Compare Source
Core Changes
Credits
Huge thanks to @mischnic, @wyattjoh, and @ztanner for helping!
v16.1.5Compare Source
Please refer the following changelogs for more information about this security release:
https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
https://vercel.com/changelog/summary-of-cve-2026-23864
v16.1.4Compare Source
v16.1.3Compare Source
v16.1.2Compare Source
v16.1.1Compare Source
Core Changes
Credits
Huge thanks to @sokra and @ztanner for helping!
v16.1.0Compare Source
v16.0.11Compare Source
Please see this changelog for more information about this security patch.
v16.0.10Compare Source
v16.0.9Compare Source
v16.0.8Compare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.