fix(deps): upgrade next to 15.5.24 (critical RCE, major) - #4
Open
devtechedge wants to merge 1 commit into
Open
devtechedge wants to merge 1 commit into
devtechedge wants to merge 1 commit into
Conversation
This is a major version upgrade. Next.js 15 requires React 19, so react / react-dom and their types move to 19 as well. Resolves 2 critical and 8 high severity advisories in next that had no Dependabot PR. Verified locally: `next build` and `tsc --noEmit` both pass.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upgrades
nextfrom14.2.3to15.5.24.This is a major upgrade. Next.js 15 requires React 19, so
react,react-dom,@types/reactand@types/react-dommove to 19 in the same change.Why
2 critical and 8 high severity advisories in
nexthad no Dependabot PR. The most severe are unauthenticated remote code execution in the Image Optimization API (GHSA-2xp9-vwfh-vxw4 / CVE-2026-75604). This repository is deployed, so the exposure is real rather than theoretical.Advisories resolved
CVE-2026-75604- Next.js: Unauthenticated Remote Code Execution on windows-hosted serversGHSA-2xp9-vwfh-vxw4- Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedCVE-2026-44573- Next.js has a Middleware / Proxy bypass in Pages Router applications using i18nCVE-2026-44578- Next.js vulnerable to server-side request forgery in applications using WebSocket upgradesCVE-2026-64641- Next.js: Denial of Service in App Router using Server ActionsCVE-2026-64645- Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostnameCVE-2026-64649- Next.js: Server-Side Request Forgery in Server Actions on custom serversGHSA-8h8q-6873-q5fj- Next.js Vulnerable to Denial of Service with Server ComponentsGHSA-h25m-26qc-wcjf- Next.js HTTP request deserialization can lead to DoS when using insecure React Server ComponentsGHSA-q4gf-8mx6-v5v3- Next.js has a Denial of Service with Server ComponentsVerification
next buildpasses (production build, all routes generated)tsc --noEmitpassesexperimental.serverComponentsExternalPackagesmoved to the stableserverExternalPackageskey (Next 15 renamed it)target: ES2017added to tsconfig (required by Next 15)E2E tests were not run locally. Merge after CI is green.