[aikido-autofix]

Upgrade Next.js and Sharp to fix critical RCE vulnerabilities in image optimization (AVIF/libheif), memory corruption on glibc Linux, and high-severity SSRF, DoS, and deserialization issues. This update includes breaking changes that require manual migration.

⚠️ Code affected by breaking changes.

⚠️ The upgrade from sharp 0.34.5 to 0.35.5 contains a breaking change that affects this codebase:

Sharp - Node.js version requirement

• Where your code is affected: The root package.json specifies "node": ">=18" (line 5), but sharp 0.35.0+ requires Node.js >= 20.9.0. Sharp is a transitive dependency of Next.js (visible in yarn.lock).

• Impact: The application will fail to install or run on Node.js 18.x, which is currently allowed by the project's engine requirements.

• Remediation: Update the engines.node field in package.json to ">=20.9.0" to match sharp's new requirement and ensure all environments (CI/CD, production, development) use Node.js 20.9.0 or higher.

All other breaking changes from both Next.js and sharp do not affect this codebase as they are not used:

• No usage of experimental.dynamicIO, experimental.strictNextHead, useMDXComponents, unstable_rootParams, AMP features, or direct sharp API calls

• No synchronous access to cookies() or headers() at runtime

• No usage of deprecated sharp properties like failOnError, paletteBitDepth, or format.jp2k

All breaking changes by upgrading next from version 15.4.8 to 15.5.28 (CHANGELOG)

Version	Description
15.5.0	refactor: rename experimental.dynamicIO to experimental.cacheComponents: #81562
15.5.0	Remove useMDXComponents argument: #80871
15.5.0	Remove experimental.strictNextHead: #81882
15.5.0	[Cache Components] Disallow sync access of cookies & headers at runtime: #82564
15.5.0	Turbopack: set window.next.turbopack instead: #82580
15.5.0	[Deprecation Warnings]: add amp deprecation warning: #82551
15.5.0	[Deprecation Warnings]: add unstable_rootParams deprecation warning: #82582
15.5.0	Stabilize node middleware support: #81907

All breaking changes by upgrading sharp from version 0.34.5 to 0.35.5 (CHANGELOG)

Version	Description
0.35.0	Drop support for Node.js 18, now requires Node.js >= 20.9.0.
0.35.0	Remove install script from package.json file. Compiling from source is now opt-in via the build script.
0.35.0	Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.
0.35.0	Add limitInputChannels with a default value of 5.
0.35.0	Remove deprecated failOnError constructor property.
0.35.0	Remove deprecated paletteBitDepth from metadata response.
0.35.0	Remove deprecated properties from sharpen operation.
0.35.0	Rename format.jp2k as format.jp2 for API consistency.

✅ 11 CVEs resolved by this upgrade, including 2 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-2xp9-vwfh-vxw4	🚨 CRITICAL	[next] A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled.
GHSA-2464-fhr4-w9xw	🚨 CRITICAL	[next] A memory-related vulnerability in the Image Optimization library can lead to remote code execution (RCE) on glibc-based Linux systems when processing images.
CVE-2026-44578	HIGH	[next] Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause th...
CVE-2026-44579	HIGH	[next] Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected c...
GHSA-mwv6-3258-q52c	HIGH	[next] A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://www.cve.org/...
GHSA-q4gf-8mx6-v5v3	HIGH	[next] A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23869](https://github.com/facebook/react/security/...
GHSA-8h8q-6873-q5fj	HIGH	[next] A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react/security/...
CVE-2026-29057	MEDIUM	[next] HTTP request smuggling vulnerability in Next.js rewrites with chunked DELETE/OPTIONS requests allows attackers to bypass route restrictions and access unintended backend endpoints. An attacker could smuggle malicious requests to internal or admin routes through request boundary disagreement between proxy and backend.
CVE-2026-44575	MEDIUM	[next] Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment ...
GHSA-w37m-7fhw-fmv9	MEDIUM	[next] A malicious HTTP request can expose compiled source code of Server Functions in affected React packages and frameworks, potentially revealing business logic through information disclosure.
GHSA-wq5f-xc86-pv6w	HIGH	[sharp] A memory vulnerability in the upstream librsvg dependency can lead to remote code execution on glibc-based Linux systems under certain runtime conditions. The vulnerability affects SVG image decoding and requires specific runtime conditions to exploit.

🤖 Remediation details

Bump next and sharp to resolve critical/high/medium security vulnerabilities

Short summary

This PR remediates security vulnerabilities in two packages: next (the direct dependency) and sharp (a transitive optional dependency pulled in by next). The next version was updated in both the root package.json (devDependencies) and the packages/demo-nextjs workspace manifest (dependencies). The sharp resolution was fixed automatically as a consequence of the next bump. Both yarn.lock and the two manifests were updated; no resolutions overrides were required.

next

next was pinned exactly at 15.4.8 in two places: the root package.json devDependencies and the packages/demo-nextjs/package.json workspace dependencies. Both pins were updated to 15.5.28, the minimum release that satisfies every listed advisory's patched-version requirement across the full set of Next.js CVEs targeted by this task. Because the version was an exact pin (no caret or tilde), Yarn would never have resolved a newer release without an explicit manifest change; updating both manifests and running yarn install --ignore-engines --ignore-scripts from the repo root refreshed the lockfile to the patched release.

sharp

sharp is not a direct dependency; it is pulled in as an optionalDependency of next. At next@15.4.8 the declared spec for sharp was ^0.34.3, which cannot resolve to 0.35.5 (a different minor series). Bumping next to 15.5.28 widened that spec to ^0.34.3 || ^0.35.5, which allows Yarn to resolve sharp to 0.35.5. No separate manifest entry or resolutions override was needed; the lockfile entry for sharp updated automatically during the same yarn install run that applied the next bump.

Version changes

Package	From	To	Why updated
next	15.4.8	15.5.28	Direct CVE fix — updated in root package.json and packages/demo-nextjs/package.json
sharp	0.34.5	0.35.5	Transitive CVE fix — resolved automatically after next bump widened its declared spec

[pr-auditor]

✅ Security Analysis Results

No security issues found. 3 files reviewed.

---

@pr-auditor rescan to re-run · Powered by Claude Sonnet 5.5 · Docs · #security-engineering-team

[jenkins-tf]

[BOT] Preview available with hash 432b7ed15d78b3d11264cd5725f2c2cd79d405c0 here.

[aikido-autofix]

Aikido's automated cron job opened a newer AutoFix. It fixes the same vulnerabilities and more: fix(security): Fix 10 security issues in next, sharp