Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #3791 +/- ##
=======================================
Coverage 98.06% 98.06%
=======================================
Files 151 151
Lines 2843 2843
Branches 556 556
=======================================
Hits 2788 2788
Misses 11 11
Partials 44 44 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
renovate
bot
force-pushed
the
renovate/npm-next-vulnerability
branch
from
3eb04b7 to
4bff5ed
Compare
renovate
bot
changed the title
next to v16 [SECURITY]next to ~15.5.0 [SECURITY]
renovate
bot
force-pushed
the
renovate/npm-next-vulnerability
branch
from
4bff5ed to
801b85b
Compare
This PR contains the following updates:
~15.4.10→~15.5.0GitHub Vulnerability Alerts
CVE-2025-59471
A DoS vulnerability exists in self-hosted Next.js applications that have
remotePatternsconfigured for the Image Optimizer. The image optimization endpoint (/_next/image) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires thatremotePatternsis configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.Strongly consider upgrading to 15.5.10 and 16.1.5 to reduce risk and prevent availability issues in Next applications.
CVE-2026-29057
Summary
When Next.js rewrites proxy traffic to an external backend, a crafted
DELETE/OPTIONSrequest usingTransfer-Encoding: chunkedcould trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.
Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so
content-length: 0is added only when bothcontent-lengthandtransfer-encodingare absent, andtransfer-encodingis no longer removed in that code path.Workarounds
If upgrade is not immediately possible:
DELETE/OPTIONSrequests on rewritten routes at your edge/proxy.CVE-2026-27980
Summary
The default Next.js image optimization disk cache (
/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.
Patches
Fixed by adding an LRU-backed disk cache with
images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. SettingmaximumDiskCacheSize: 0disables disk caching.Workarounds
If upgrade is not immediately possible:
.next/cache/images.images.localPatterns,images.remotePatterns, andimages.qualities)Release Notes
vercel/next.js (next)
v15.5.14Compare Source
v15.5.13Compare Source
v15.5.12Compare Source
This is a re-release of v15.5.11 applying the turbopack changes.
v15.5.11Compare Source
Core Changes
Credits
Huge thanks to @timneutkens, @mischnic, @ztanner, and @wyattjoh for helping!
v15.5.10Compare Source
Please refer the following changelogs for more information about this security release:
v15.5.9Compare Source
v15.5.8Compare Source
v15.5.7Compare Source
v15.5.6Compare Source
Core Changes
Credits
Huge thanks to @mischnic for helping!
v15.5.5Compare Source
Core Changes
experimental.middlewareClientMaxBodySizebody cloning limit (#84722)Misc Changes
Credits
Huge thanks to @devjiwonchoi, @ztanner, and @icyJoseph for helping!
v15.5.4Compare Source
Core Changes
Misc Changes
Credits
Huge thanks to @yiminghe, @huozhi, @devjiwonchoi, @mischnic, @lukesandberg, @ztanner, @icyJoseph, @leerob, @fufuShih, @dwrth, @aymericzip, @obendev, @molebox, @OoMNoO, @pontasan, @styfle, @HondaYt, @ryuapp, @lpalmes, and @ijjk for helping!
v15.5.3Compare Source
Core Changes
Credits
Huge thanks to @bgub for helping!
v15.5.2Compare Source
Core Changes
Credits
Huge thanks to @bgub and @ztanner for helping!
v15.5.1Compare Source
Core Changes
Credits
Huge thanks to @bgub, @mischnic, and @ztanner for helping!
v15.5.0Compare Source
Core Changes
@typescript-eslint/switch-exhaustiveness-checkrule: #81583React.unstable_postpone(): #81652images.qualitiesis undefined: #81690pprordynamicIOenabled: #81668__turbopack_load_by_url__: #8166397cdd5d3-20250710to2f0e7e57-20250715: #81678renderToStringfunction: #817072f0e7e57-20250715tod85ec5f5-20250716: #81708next-serverVM: #81664headers/cookies/draftModein'use cache': #81716d85ec5f5-20250716todffacc7b-20250717: #81767getExpectedRequestStorefunction: #81791.next/cache: #81807dffacc7b-20250717toe9638c33-20250721: #81899'use cache: private': #81816browserslist: #81851run-turbopack-compilertrace span: #81917e9638c33-20250721to7513996f-20250722: #819407513996f-20250722toedac0dde-20250723: #81984exhaustive-depsviolations: #82010edac0dde-20250723to3d14fcf0-20250724: #820203d14fcf0-20250724to19baee81-20250725: #8206319baee81-20250725toeaee5308-20250728: #82120eaee5308-20250728to9be531cd-20250729: #82159@next/codemod: update docs url in README: #82135@next/codemod: Addexperimental.turbototurbopackcodemod for Next.js configs: #82134NextRequesttypes: #821729be531cd-20250729to9784cb37-20250730: #82207TURBOPACKenv before loading config: #82162outputFileTracingRootorturbopack.rootoption is provided: #821649784cb37-20250730toc260b38d-20250731: #82247eslint-plugin-react-hooksin React sync: #82294c260b38d-20250731tobe11cb5c-20250804: #82339_errorpage'sreq.urlcan be overwritten to dynamic param on minimal mode: #82347asPathfor query-only navigation withuseRouter: #82236?dplto fonts in/_next/static/media: #82384be11cb5c-20250804to7deda941-20250804: #82373pathto Image documentation: #823297deda941-20250804to3958d5d8-20250807: #824473958d5d8-20250807tof1e70b5e-20250811: #82534f1e70b5e-20250811toac7820a9-20250811: #82543image-sizepkg as additional format detector: #82538?dplto fonts in/_next/static/mediapart 2: #82488componentStackFramesfield: #82395skipMetadata: #82569ac7820a9-20250811to1dc3bdea-20250812: #82575Mapsupport fromnext/dynamictransform: #82487window.next.turbopackinstead: #825801dc3bdea-20250812tof1222f76-20250812: #82595f1222f76-20250812to379a083b-20250813: #82642turbo_tasks::spawn: #82634379a083b-20250813toa96a0f39-20250815: #82691turbopack.rootvalue foroutputFileTracingRootto have consistent tracing root: #82653Example Changes
with-supabaseexample to usegetClaims(): #81383Misc Changes
beforePageLoadto be async: #81650ImportedBindingeffect creation to avoid as much special-casing of SimpleAssignTarget: #81653use-cachetest suite in the Cache Components tests: #81610app-staticdeploy test: #81712requireto load chunks in our node runtime: #81738experimental.strictNextHead: #81882current_valueset/restore mutation pattern with a saferwith_pat_valuehelper: #81696global-not-found: #81803next build --turbopack: #81704lint-eslinton a specific directory: #82009rcstr!allocated Rcstr values as 'static' and stop refcounting them: #81994hash: #82084constcompatible hash routine performance: #82088Configuration
📅 Schedule: Branch creation - "" in timezone America/Chicago, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.