fix(deps): update dependency next to v16.4.1 [security] by renovate[bot] · Pull Request #608 · LedgerHQ/wallet-api

renovate · 2026-09-11T03:54:10Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	`16.2.7` → `16.4.1`

Next.js: Denial of Service in App Router using Server Actions

CVE-2026-64641 / GHSA-m99w-x7hq-7vfj

More information

Details

Impact

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.

Workarounds

No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

Severity

CVSS Score: 8.2 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

CVE-2026-64642 / GHSA-6gpp-xcg3-4w24

More information

Details

Impact

Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication.

Workarounds

If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.

Severity

CVSS Score: 8.3 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

CVE-2026-64645 / GHSA-p9j2-gv94-2wf4

More information

Details

Impact

A rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect.

This affects any destination that puts a dynamic segment in the hostname, whether from the path:

// next.config.js
module.exports = {
  async rewrites() {
    return [
      {
        source: '/:tenant',
        destination: 'https://:tenant.api.example.com',
      },
    ]
  },
}

or from a has capture:

// next.config.js
module.exports = {
  async rewrites() {
    return [
      {
        source: '/',
        has: [{ type: 'query', key: 'region', value: '(?<region>.+)' }],
        destination: 'https://:region.api.example.com',
      },
    ]
  },
}

Workarounds

If you cannot upgrade immediately, do not build the hostname of an external rewrites() or redirects() destination from user-controlled input. If a dynamic subdomain is required, constrain the value to hostname-safe characters: value: '(?<region>[a-z0-9-]+)'.

Severity

CVSS Score: 8.3 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js: Server-Side Request Forgery in Server Actions on custom servers

CVE-2026-64649 / GHSA-89xv-2m56-2m9x

More information

Details

Impact

When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization.

Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward.

Workarounds

If you cannot upgrade, ensure clients do not control the host header your application receives. Pin or validate Host and X-Forwarded-Host at your edge or proxy. On version 14.2.0 and later, you can additionally set the __NEXT_PRIVATE_ORIGIN environment variable to your deployment's real origin:

__NEXT_PRIVATE_ORIGIN=https://www.example.com node server.js

#### Severity
- CVSS Score: 8.3 / 10 (High)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`

#### References
- [https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x)
- [https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b](https://redirect.github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b)
- [https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498](https://redirect.github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498)
- [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)
- [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)
- [https://github.com/advisories/GHSA-89xv-2m56-2m9x](https://redirect.github.com/advisories/GHSA-89xv-2m56-2m9x)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-89xv-2m56-2m9x) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
[CVE-2026-75604](https://nvd.nist.gov/vuln/detail/CVE-2026-75604) / [GHSA-p293-qw3h-jr36](https://redirect.github.com/advisories/GHSA-p293-qw3h-jr36)

<details>
<summary>More information</summary>

#### Details
##### Impact

A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.

##### Workaround

There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.

#### Severity
- CVSS Score: 9.0 / 10 (Critical)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H`

#### References
- [https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36)
- [https://nvd.nist.gov/vuln/detail/CVE-2026-75604](https://nvd.nist.gov/vuln/detail/CVE-2026-75604)
- [https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b](https://redirect.github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b)
- [https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3](https://redirect.github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3)
- [https://github.com/vercel/next.js/releases/tag/v15.5.24](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.24)
- [https://github.com/vercel/next.js/releases/tag/v16.3.3](https://redirect.github.com/vercel/next.js/releases/tag/v16.3.3)
- [https://github.com/advisories/GHSA-p293-qw3h-jr36](https://redirect.github.com/advisories/GHSA-p293-qw3h-jr36)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-p293-qw3h-jr36) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
[GHSA-2xp9-vwfh-vxw4](https://redirect.github.com/advisories/GHSA-2xp9-vwfh-vxw4)

<details>
<summary>More information</summary>

#### Details
A vulnerability in the underlying `libheif` library used by `sharp` which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.

Until a fix has propagated, optimization of AVIF files is disabled.

#### Severity
- CVSS Score: 9.5 / 10 (Critical)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

#### References
- [https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497](https://redirect.github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497)
- [https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4)
- [https://github.com/vercel/next.js/pull/97875](https://redirect.github.com/vercel/next.js/pull/97875)
- [https://github.com/vercel/next.js/pull/97931](https://redirect.github.com/vercel/next.js/pull/97931)
- [https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3](https://redirect.github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3)
- [https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2](https://redirect.github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2)
- [https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998](https://redirect.github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998)
- [https://github.com/vercel/next.js/releases/tag/v15.5.24](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.24)
- [https://github.com/vercel/next.js/releases/tag/v16.3.3](https://redirect.github.com/vercel/next.js/releases/tag/v16.3.3)
- [https://github.com/advisories/GHSA-2xp9-vwfh-vxw4](https://redirect.github.com/advisories/GHSA-2xp9-vwfh-vxw4)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-2xp9-vwfh-vxw4) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Next.js has Server-Side Request Forgery in Image Optimization
[CVE-2026-94483](https://nvd.nist.gov/vuln/detail/CVE-2026-94483) / [GHSA-cjq9-62q9-8jv4](https://redirect.github.com/advisories/GHSA-cjq9-62q9-8jv4)

<details>
<summary>More information</summary>

#### Details
##### Impact

An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization. 

##### Workaround

Audit allow-listed remote URLs in `images.remotePatterns` (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no `images.remotePatterns` are configured, your app is not affected.

#### Severity
- CVSS Score: 8.3 / 10 (High)
- Vector String: `CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`

#### References
- [https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4)
- [https://nvd.nist.gov/vuln/detail/CVE-2026-94483](https://nvd.nist.gov/vuln/detail/CVE-2026-94483)
- [https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b](https://redirect.github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b)
- [https://github.com/vercel/next.js/releases/tag/v16.3.8](https://redirect.github.com/vercel/next.js/releases/tag/v16.3.8)
- [https://github.com/advisories/GHSA-cjq9-62q9-8jv4](https://redirect.github.com/advisories/GHSA-cjq9-62q9-8jv4)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-cjq9-62q9-8jv4) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Next.js: Remote Code Execution in next/og ImageResponse
[GHSA-vcvr-r3jv-pc5j](https://redirect.github.com/advisories/GHSA-vcvr-r3jv-pc5j)

<details>
<summary>More information</summary>

#### Details
##### Impact

The Node.js `ImageResponse` implementation from `next/og` is affected by an upstream vulnerability. This can lead to remote code execution.

Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:

```tsx
import { ImageResponse } from 'next/og'

export async function GET(request: Request) {
  const value = new URL(request.url).searchParams.get('value') ?? ''

  return new ImageResponse(
    <svg width="1200" height="630">
      <title>{value}</title>
    </svg>
  )
}

Applications using the Edge ImageResponse implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.

Workaround

If upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation from next/og.

Severity

CVSS Score: 9.5 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

GHSA-2464-fhr4-w9xw

More information

Details

Impact

A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.

Workaround

Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp.
Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.

Severity

CVSS Score: 9.5 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js: Denial of Service in App Router using Server Actions

CVE-2026-94482 / GHSA-p3m5-59mp-jv5r

More information

Details

Impact

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.

Workarounds

No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

Severity

CVSS Score: 8.2 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

GHSA-673q-mjm6-r5xr

More information

Details

Impact

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.

Workaround

There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

Severity

CVSS Score: 9.5 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vercel/next.js (next)

`v16.4.1`

Compare Source

This release contains security fixes for the following advisories:

Critical:

High:

Denial of Service in App Router using Server Actions

`v16.4.0`

Compare Source

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

Show compiler plugin warning in more situations: #75682
fix(scripts): correct typo in rm.mjs error message: #87015
docs: improve clarity and punctuation in README: #86096
Fix debug build paths Pages Router support entries: #93529
bundle-analyzer: record historical snapshots on each analyze run: #93520
fix: detect proxy.ts correctly with compound pageExtensions: #93246
feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

docs: correction to dynamicParams migration: #96624
docs: proxy event argument: #96435
docs: remove experimental note from runtime prefetching: #96615
Preserve per-segment prefetching after dynamic navigation: #96583
Rename static generation stream option to waitForAllReady: #96564
Remove obsolete static generation plumbing: #96563
[turbopack] Drop dead writes to exports: #96381
[turbopack] Ignore writes to exports after a module.exports = {} writes: #96380
[turbopack] Add test for sideEffects with optimizePackageImports: #96549
[turbopack] Strip leading BOM before parsing CSS: #96678
Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550
docs: use relative doc links in instant-navigation error pages: #96672
Turbopack: terminate failed plugin worker threads: #96592
Fix HTML-limited bot matching in prerender bypass rules: #96584
[ci] Fix create_release_branch for new repo permissions: #96641
test: skip action module instance deploy test: #96629
docs: quote the dynamicParams build error in a blockquote: #96633
[react-sync] Open pull requests as the bot that authors the commits: #96682
[Bench] Fixes for pure Fizz bench: #96771
Derive foreground cache revalidation from the consumer: #96731
Fix race when navigating Back before hydration: #96252
docs: present each Skill as steps in the AI agents guide: #96751
Reuse completed cache entries for the rest of a request: #96727
Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #96735
Remove WorkStore execution mode: #96674
Remove cache revalidation execution mode reads: #96670
Separate App Route render and prerender pipelines: #96662
Remove App Page execution mode reads: #96660
test: fix missing await in css-chunking test: #96725
docs (Skills): stop assuming app/ at the root and port 3000: #96696
Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #95808
Use Tailwind Turbopack loader in create-next-app: #96606
docs: instant navigation quick start with an adoption prompt: #96663
Separate App Page render and prerender pipelines: #96659
Move App Router execution intent to entrypoints: #96640
Pass explicit render capabilities through App Render: #96576
Pass explicit prefetch hint policy through App Render: #96572
Replace WorkStore isStaticGeneration with executionMode: #96570
docs: document ! exclusion and src/ prefix for --debug-build-paths: #96703
Change loadManifest to return undefined with handleMissing: #96530
Refactor server from CacheNodeSeedData -> TransportData: #96679
Unify full/partial navigation response types: #96439
Unify RouteTree and CacheNodeSeedData on the client: #96406
Consolidate Promise.withResolvers polyfills: #96772
[ci] Open automated update pull requests with nextjs-bot: #96683
Require Cache Components for Instant Navigation testing: #96745
Fix use cache over- and under-invalidation in dev: #96235
Fix which pages the dev server announces, and when: #96250
docs: update redirected links to current targets: #96723
Fix(deployment-id): prevent exception on old webkit: #94604
[fragment-scroll] Remove config.experimental.appNewScrollHandler: #95602
[turbopack] Enable reexport-unknown execution test: #96774
ci: stop publishing @vercel/devlow-bench: #96887
fix(turbopack): name the module in the non-ESM-placeable error, and stop duplicating the importer in traces: #96560
fix(turbopack): support type: 'text' in rules, and error on binding imports of non-ESM modules: #96558
Lint devlow-bench with the root eslint config: #96871
Remove turbopack/packages and relocate devlow to packages/: #96860
Flush pending revalidations for forwarded action error responses: #96945
Handle Server Actions on dynamic PPR fallback routes: #96932
Turbopack: Improve how DiskWatcher is configured and fix polling watcher bugs: #96440
Turbopack: Allow DiskWatcher to use a mocked DiskFileSystem, add a small unit test: #96353
[turbopack] Add e2e test that uses component chunks + workers: #96556
[turbopack] Support experimental.serverMinification & expand experimental.turbopackMinify: #96578
Add a turbopackChunking documentation page for pages router: #96698
[turbopack] Don't run Webpack tests on Turbopack-only changes: #96656
[turbopack] Enable the shared runtime by default: #96778
[turbopack] Enable CJS tree shaking by default: #96779
refactor: clean up places that needlessly list all RenderStages: #96907
Fix the documented invocation for generating tests non-interactively: #96896
Make NextConfigComplete typing more accurate: #96700
Upgrade to swc 75: #96702
docs: link View Transitions skill on skills.sh and clarify the example prompt: #96863
[ci] Reset the turbopack deploy test project in the weekly cron: #96822
docs: add authentication with Cache Components guide and iron-session example: #95802
[turbopack] Fix a potential deadlock in scope_and_block: #95695
Remove the turbopack-build-events trace span, use next build instead: #96746
docs: add export const dynamic = 'force-static' to Route Handlers example on Static Exports: #96964
[turbopack] Follow re-exports for side-effect free async modules: #95993
[turbopack] Treat constants with values referencing other values as unsafe: #96190
[refactor] Rename encodeCacheTag to encodeHeaderSafe: #96936
Fix formatting of Google Fonts section in documentation: #88447
Fixing a bug - typo issue fixed: #97141
examples: fix Webiny API env variable name: #97134
docs: fix Link prefetch grammar and Client Components wording: #97132
Use emitted app entries for post-build processing: #97139
docs(mdx): fix package name in .md handling section: #97131
[turbopack] Reduce native React Compiler work: #96820
docs: rename repo to repository for consistency: #87849
Fix typo in Data Access Layer section: #87202
docs: runtime prefetching -> optimizing prefetching: #96934
[CC] Track APIs that cause incompatible static/app shells: #97040
Fix client component loading span timing: #96455
Trace development route compilation: #96454
Prefix 'use cache' debug logs with the full directive: #97037
Revert "[turbopack] Enable CJS tree shaking by default (#96779)": #97018
Revert "[turbopack] Follow re-exports for side-effect free async modules": #97009
[fragment-scroll] Rename ScrollAndMaybeFocusHandler to ScrollHandler: #96828
Trace development route preparation: #96453
test: cleanup Turbopack snapshot config: #97013
Remove unused htmlLimitedBots from renderOpts: #96701
fix(turbopack): point at the glob that matched a file with no module type: #96561
[turbopack] Bail CJS tree-shaking on var x = module.exports = {}: #97130
docs: server client and directives: #96145
docs: clarify client cache freshness after hydration: #97180
docs: create client-side fetching guide: #96341
Turbopack: accept a module type argument for import.meta.glob: #96991
docs: align Cache Components authentication guide title: #97143
test: re-enable a few more passing NFT unit cases: #97017
[turbopack] Do the CJS analysis needed for scope hoisting: #95826
Remove legacy PPR code paths: #96868
Use Cache Components as the internal PPR signal: #96827
Make legacy PPR paths explicit: #96753
fix: typos in code comments: #97137
Fix spelling in two comments: #97136
Decouple loader tree construction from children ordering: #97192
Bump lightningcss: #97159
Update gh-stack skill guidance: #97163
[test] Unflake use-cache-custom-handler-dev tests: #97187
Forward a build-container pin to deploy-test deployments: #97191
Fix shared Turbopack runtime initialization race: #97215
Fix stale data after navigation despite revalidation: #95439
[turbopack] Only use the shared runtime by default on canary: #97208
test: fix 'ouput' typo in parseIdsFromCliOutput: #97266
Add the mtime fallback back: #97268
Allow issue participants to request reopening: #96947
[turbopack] Document clusters for chunking: #97267
Link to issues in the contribution guide and discourage trivial PRs: #97188
Stop serializing hmr version state: #97146
[turbopack] Add clusters to chunking heuristics: #95157
[test] Redirect the deployment host in-process for proxy deploy tests: #97260
[test] Unflake two cache-components-dev-streaming assertions: #97246
[test] Unflake use-cache-default-profile-expire-zero tests: #97250
Allow running ncc before pnpm build: #97234
Invalidate deferred Webpack entry sources: #97205
Unify how a response's shell and full payloads are written: #96878
Convert per-segment prefetches to NavigationFlightResponse format: #96877
Unify how server responses are written into the client cache: #96876
Convert tree prefetches to NavigationFlightResponse format: #96788
fix(next/image): skip 0-byte entries when initializing disk LRU cache: #94068
Update authentication diagram URL: #97320
Add a script for adopting fork pull requests: #97252
Migrate napi-rs bindings from v2 to v3: #95412
Upgrade React from 11eddecd-20260805 to 22e4f993-20260811: #97249
Add RDC compression rollout controls: #97247
[testmode] Fix infinite recursion in testmode passthrough fetch: #96525
Turbopack: add imports_wildcard NFT unit test: #97373
Turbopack: improve chunk_item_content docs: #97370
test: Reenable i18n-api-support deploy test for Turbopack with adapters: #96898
Trace instrumentation startup: #97296
Trace route module preparation: #97295
Trace route module loading: #97318
fix(deps): bump satori and @vercel/og: #97276
[test] Cover 'use cache: private' in route handlers: #97349
Fix missing Pages runtime in adapter Pages API outputs: #96819
docs: align SPA guide reducer example with React conventions: #97341
Update blob version.: #97342
Upgrade React from 22e4f993-20260811 to eb8feb71-20260814: #97382
Adopt SelectedMetadata for metadata rendering: #97387
fix(next/image): reject empty image on read/write to disk cache : #97278
Turbopack: remove stale manifests for deleted routes: #97333
Turbopack: make unreachable codegen more generic: #97385
Wait for back-before-hydration recoveries in the browser: #97321
Extract metadata resolution primitives: #97388
test: update React 18 redbox snapshot: #97415
Remove server route matcher stack: #94157
Anchor the async local storage instances to global symbols: #97255
test: deflake use-cache-size-zero warm reload: #97421
Scaffolding for concurrentRouterQueue flag: #97413
Reorganize client router modules: #97402
fix(turbo-persistence): allow 32-bit usize conversion: #97288
test: restore missing NFT exports* unit fixtures: #97459
[ci] Fix backport canary release dispatch: #97383
turbo-tasks-backend: Enforce that tasks exist when accessing them: #96043
turbo-tasks-backend: add persistence delete/tombstone plumbing for GC: #95975
turbo-persistence: add key-value tombstones for MultiValue families: #96929
Trace lazy App Route module loading: #97439
[ci] Wait for the next version to be available on npm before deploy tests: #97460
docs: fix stale Dev Overlay README link in contributing guide: #97486
docs: app router reference accuracy: #97477
test: Don't wait trying to load non-existing images: #97488
test: cover dynamic APIs with i18n base path: #97367
style(examples): remove redundant justify-content declaration: #97222
docs: rename Vercel Edge Config to Global Config in redirecting guide: #97456
fix: improve form accessibility by associating labels with inputs: [#96335

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2026-09-11T03:54:15Z

⚠️ No Changeset found

Latest commit: de39ce2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2026-09-11T03:54:16Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
wallet-api-wallet-api-tools	Ready	Preview	Nov 6, 2026 12:13am UTC

renovate Bot requested review from a team, ComradeAERGO and Justkant as code owners September 11, 2026 03:54

vercel Bot deployed to Preview September 11, 2026 03:54

View deployment

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 292e60f to d8c49dc Compare September 15, 2026 19:03

vercel Bot deployed to Preview September 15, 2026 19:03

View deployment

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from d8c49dc to c565626 Compare September 24, 2026 23:29

vercel Bot deployed to Preview September 24, 2026 23:30

View deployment

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from c565626 to 4381ac8 Compare September 29, 2026 14:46

vercel Bot deployed to Preview September 29, 2026 14:47

View deployment

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 4381ac8 to c9fbe63 Compare October 1, 2026 11:33

vercel Bot deployed to Preview October 1, 2026 11:33

View deployment

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from c9fbe63 to b70b58d Compare October 13, 2026 18:14

vercel Bot deployed to Preview October 13, 2026 18:16

View deployment

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from b70b58d to a45c353 Compare October 16, 2026 00:37

renovate Bot changed the title ~~fix(deps): update dependency next to v16.3.3 [security]~~ fix(deps): update dependency next to v16.3.8 [security] Oct 16, 2026

vercel Bot deployed to Preview October 16, 2026 00:38

View deployment

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from a45c353 to 439a34c Compare October 22, 2026 09:15

vercel Bot deployed to Preview October 22, 2026 09:15

View deployment

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 439a34c to 88c59fa Compare November 1, 2026 02:28

renovate Bot changed the title ~~fix(deps): update dependency next to v16.3.8 [security]~~ fix(deps): update dependency next to v16.4.1 [security] Nov 1, 2026

vercel Bot deployed to Preview November 1, 2026 02:29

View deployment

fix(deps): update dependency next to v16.4.1 [security]

de39ce2

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 88c59fa to de39ce2 Compare November 6, 2026 00:12

vercel Bot deployed to Preview November 6, 2026 00:13

View deployment

Navigation Menu

Repository navigation

fix(deps): update dependency next to v16.4.1 [security] - #608

fix(deps): update dependency next to v16.4.1 [security]#608
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-next-vulnerability

renovate Bot commented Sep 11, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Sep 11, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Sep 11, 2026 •

edited

Loading

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Next.js: Denial of Service in App Router using Server Actions

Details

Impact

Workarounds

Severity

References

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Details

Impact

Workarounds

Severity

References

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Details

Impact

Workarounds

Severity

References

Next.js: Server-Side Request Forgery in Server Actions on custom servers

Details

Impact

Workarounds

Workaround

Severity

References

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

Details

Impact

Workaround

Severity

References

Next.js: Denial of Service in App Router using Server Actions

Details

Impact

Workarounds

Severity

References

Next.js: Unauthenticated Remote Code Execution in use cache functions returning typed arrays

Details

Impact

Workaround

Severity

References

Release Notes

v16.4.1

v16.4.0

Core Changes

Misc Changes

Configuration

Uh oh!

changeset-bot Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

vercel Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Sep 11, 2026 •

edited

Loading

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

`v16.4.1`

`v16.4.0`

changeset-bot Bot commented Sep 11, 2026 •

edited

Loading

vercel Bot commented Sep 11, 2026 •

edited

Loading