fix(security): Fix security issue in next via minor version upgrade from 15.4.8 to 15.5.24

[aikido-autofix]

Upgrade Next.js to fix critical RCE in AVIF image optimization, SSRF in WebSocket requests, DoS via connection exhaustion and CPU exhaustion in Server Functions, and disable AVIF optimization until patched.

✅ Code not affected by breaking changes.

✅ No breaking changes from the Next.js 15.4.8 to 15.5.24 upgrade affect this codebase.

The codebase contains a Next.js demo application (packages/demo-nextjs) that uses:

• Basic Next.js features (App Router and Pages Router)

• Client components with 'use client' directive

• Standard hooks like useSearchParams, useRouter

• No experimental features

• No AMP configuration

• No MDX components

• No server-side usage of cookies() or headers()

• No middleware files

• No unstable_rootParams usage

All breaking changes listed in the changelog (removal of experimental.dynamicIO, useMDXComponents, experimental.strictNextHead, sync access restrictions for cookies/headers, AMP deprecation, and unstable_rootParams deprecation) have zero impact on this codebase.

All breaking changes by upgrading next from version 15.4.8 to 15.5.24 (CHANGELOG)

Version	Description
15.5.0	refactor: rename experimental.dynamicIO to experimental.cacheComponents: #81562
15.5.0	Remove useMDXComponents argument: #80871
15.5.0	Remove experimental.strictNextHead: #81882
15.5.0	[Cache Components] Disallow sync access of cookies & headers at runtime: #82564
15.5.0	Turbopack: set window.next.turbopack instead: #82580
15.5.0	[Deprecation Warnings]: add amp deprecation warning: #82551
15.5.0	[Deprecation Warnings]: add unstable_rootParams deprecation warning: #82582
15.5.0	Stabilize node middleware support: #81907

✅ 8 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-2xp9-vwfh-vxw4	🚨 CRITICAL	[next] A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled.
CVE-2026-44578	HIGH	[next] A server-side request forgery vulnerability in self-hosted Next.js applications allows attackers to craft WebSocket upgrade requests that proxy arbitrary requests to internal or external destinations, potentially exposing internal services or cloud metadata. Vercel-hosted deployments are unaffected.
CVE-2026-44579	HIGH	[next] Applications using Partial Prerendering with Cache Components are vulnerable to connection exhaustion via crafted POST requests to server actions, causing request-body handling deadlocks that consume server resources and lead to denial of service. Malicious actors can exhaust file descriptors and server capacity, preventing legitimate users from accessing the application.
GHSA-q4gf-8mx6-v5v3	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
GHSA-8h8q-6873-q5fj	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
CVE-2026-44575	MEDIUM	[next] Authorization bypass in App Router allows unauthorized access to protected content through transport-specific route variants (.rsc and segment-prefetch URLs) that bypass middleware checks. Attackers can reach protected pages without passing intended authorization validation.
CVE-2026-64641	MEDIUM	[next] Crafted requests targeting Next.js applications with App Router and Server Actions can cause excessive CPU usage, leading to denial of service by blocking request processing. This vulnerability allows attackers to exhaust server resources and prevent legitimate requests from being handled.
GHSA-w37m-7fhw-fmv9	MEDIUM	[next] A malicious HTTP request can expose compiled source code of Server Functions in affected React packages and frameworks, potentially revealing business logic through information disclosure.

🤖 Remediation details

Bump next to 15.5.24 to remediate multiple security vulnerabilities

Short summary

This PR fixes multiple security vulnerabilities in next (Next.js) by upgrading it from 15.4.8 to 15.5.24. The package appeared as a direct dependency in two places: the root package.json (devDependencies) and the packages/demo-nextjs workspace member (dependencies). Both declarations and the shared yarn.lock were updated.

next

next was pinned at the exact version 15.4.8 in both the root package.json and the packages/demo-nextjs workspace manifest, making it a direct dependency in both locations. Both pins were updated to 15.5.24—the minimum version that satisfies all patched-version requirements across the full set of advisories affecting this package (the highest floor being 15.5.24 for GHSA-2xp9-vwfh-vxw4). Because both manifests shared the same exact pin, the related-package-alignment policy required moving them together; updating only the root would have left the workspace-driven next@15.4.8 lockfile entry alive. After both manifests were updated, yarn install --ignore-engines --ignore-scripts was run from the repo root, collapsing the lockfile to a single next@15.5.24 entry.

Version changes

Package	From	To	Why updated
next (root package.json devDependencies)	15.4.8	15.5.24	Direct CVE fix
next (packages/demo-nextjs dependencies)	15.4.8	15.5.24	Direct CVE fix — aligned with root pin per related-package-alignment policy

[pr-auditor]

✅ Security Analysis Results

No security issues found. 3 files reviewed.

---

@pr-auditor rescan to re-run · Powered by Claude Sonnet 5 · Docs · #security-engineering-team