Skip to content

[Aikido] Fix security issue in next via minor version upgrade from 15.4.8 to 15.5.15#39

Open
aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/aikido-security-update-packages-31896109-6fbw
Open

[Aikido] Fix security issue in next via minor version upgrade from 15.4.8 to 15.5.15#39
aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/aikido-security-update-packages-31896109-6fbw

Conversation

@aikido-autofix
Copy link
Copy Markdown
Contributor

@aikido-autofix aikido-autofix Bot commented May 8, 2026

Upgrade Next.js to fix DoS vulnerability in React Server Components that allows excessive CPU usage via crafted HTTP requests to App Router endpoints.

✅ Code not affected by breaking changes.

✅ No breaking changes from the Next.js 15.4.8 to 15.5.15 upgrade affect this codebase. The project does not use any of the deprecated or modified features including:

  • No experimental features (dynamicIO, cacheComponents, strictNextHead) in the Next.js config

  • No MDX components or useMDXComponents usage

  • No server-side usage of cookies() or headers() from next/headers

  • No AMP configuration

  • No unstable_rootParams usage

  • No Turbopack-specific code

The upgrade can proceed safely.

All breaking changes by upgrading next from version 15.4.8 to 15.5.15 (CHANGELOG)

Version Description
15.5.0
refactor: rename experimental.dynamicIO to experimental.cacheComponents: #81562
15.5.0
Remove useMDXComponents argument: #80871
15.5.0
Remove experimental.strictNextHead: #81882
15.5.0
[Cache Components] Disallow sync access of cookies & headers at runtime: #82564
15.5.0
Turbopack: set window.next.turbopack instead: #82580
15.5.0
[Deprecation Warnings]: add amp deprecation warning: #82551
15.5.0
[Deprecation Warnings]: add unstable_rootParams deprecation warning: #82582
15.5.0
Stabilize node middleware support: #81907
✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
GHSA-q4gf-8mx6-v5v3
MEDIUM
[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants