This repository was archived by the owner on Jul 29, 2026. It is now read-only.
fix(security): upgrade Next.js 16.2.0 → 16.2.10 to patch 14 CVEs - #90
Draft
caimanoliveira wants to merge 1 commit into
Draft
fix(security): upgrade Next.js 16.2.0 → 16.2.10 to patch 14 CVEs#90caimanoliveira wants to merge 1 commit into
caimanoliveira wants to merge 1 commit into
Conversation
Fixes 14 high/critical vulnerabilities in next@16.2.0 including: - Multiple Middleware/Proxy bypass vectors (GHSA-267c-6grr-h53f, GHSA-492v-c6pp-mqqv, GHSA-26hh-7cqf-hhc6, GHSA-36qx-fr4f-26g5) - Cache poisoning in RSC responses (GHSA-wfc6-r584-vfw7, GHSA-vfv6-92ff-j949, GHSA-3g8h-86w9-wvmq) - Denial of Service via Server Components and Cache Components (GHSA-q4gf-8mx6-v5v3, GHSA-8h8q-6873-q5fj, GHSA-mg66-mrh9-m8jx, GHSA-h64f-5h5j-jqjh) - XSS via CSP nonces and beforeInteractive scripts (GHSA-ffhc-5mcf-pf4q, GHSA-gx5p-jg67-6x7h) - SSRF via WebSocket upgrades (GHSA-c4j6-fc7j-m34r) Also removes ws uninitialized memory disclosure via npm audit fix. Build confirmed green — all 22 routes pass TypeScript and static gen. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NmU3dL1izQrdcspZCaCGVQ
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nextfrom16.2.0→16.2.10to patch 14 high-severity CVEswsuninitialized-memory-disclosure vulnerability vianpm audit fixCVEs fixed in Next.js 16.2.10
Remaining known issue
postcss <8.5.10(moderate, GHSA-qx2v-qp2m-jg93) is bundled insidenode_modules/next/node_modules/postcss— it cannot be overridden without downgrading to a breaking Next.js version.There are currently 30 open PRs on this repo all attempting the same Next.js upgrade. This is being caused by the automated routine re-running daily without any PRs being merged. Please merge one and close the others, or merge this one directly.
Generated by Claude Code