[aikido-autofix]

Upgrade Next.js and Sharp to fix critical RCE vulnerabilities in image optimization (AVIF/libheif), memory corruption, and high-severity DoS/SSRF issues. This update includes breaking changes that require manual migration.

⚠️ Code affected by breaking changes.

⚠️ The upgrade has one breaking change that affects this codebase:

Sharp 0.35.0 Node.js version requirement

• Where your code is affected: The entire project, particularly packages/demo-nextjs/package.json which depends on Next.js 15.4.8, and the root package.json which specifies "engines": { "node": ">=18" }.

• Impact: Sharp 0.35.0 requires Node.js >= 20.9.0, but the project currently specifies Node.js >= 18. Sharp is an optional dependency of Next.js (as seen in yarn.lock), used for image optimization. While it's optional, Next.js will attempt to use it if available, and the version mismatch will cause installation or runtime failures when Next.js tries to leverage sharp for image processing.

• Remediation: Update the engines.node field in package.json and packages/embed/package.json and packages/embed-react/package.json to ">=20.9.0" to match sharp's requirement. Ensure your CI/CD pipelines and development environments use Node.js 20.9.0 or higher.

All breaking changes by upgrading next from version 15.4.8 to 15.5.28 (CHANGELOG)

Version	Description
15.5.0	refactor: rename experimental.dynamicIO to experimental.cacheComponents: #81562
15.5.0	Remove useMDXComponents argument: #80871
15.5.0	Remove experimental.strictNextHead: #81882
15.5.0	[Cache Components] Disallow sync access of cookies & headers at runtime: #82564
15.5.0	Turbopack: set window.next.turbopack instead: #82580
15.5.0	[Deprecation Warnings]: add amp deprecation warning: #82551
15.5.0	[Deprecation Warnings]: add unstable_rootParams deprecation warning: #82582
15.5.0	Stabilize node middleware support: #81907

All breaking changes by upgrading sharp from version 0.34.5 to 0.35.5 (CHANGELOG)

Version	Description
0.35.0	Drop support for Node.js 18, now requires Node.js >= 20.9.0.
0.35.0	Remove install script from package.json file. Compiling from source is now opt-in via the build script.
0.35.0	Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.
0.35.0	Add limitInputChannels with a default value of 5.
0.35.0	Remove deprecated failOnError constructor property.
0.35.0	Remove deprecated paletteBitDepth from metadata response.
0.35.0	Remove deprecated properties from sharpen operation.
0.35.0	Rename format.jp2k as format.jp2 for API consistency.

✅ 10 CVEs resolved by this upgrade, including 2 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-2xp9-vwfh-vxw4	🚨 CRITICAL	[next] A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled.
GHSA-2464-fhr4-w9xw	🚨 CRITICAL	[next] A memory-related vulnerability in the upstream Image Optimization library can lead to remote code execution (RCE) on glibc-based Linux systems when processing images.
CVE-2026-44578	HIGH	[next] Self-hosted applications are vulnerable to server-side request forgery (SSRF) through crafted WebSocket upgrade requests, allowing attackers to proxy requests to arbitrary destinations and potentially expose internal services or cloud metadata. Vercel-hosted deployments are unaffected.
CVE-2026-44579	HIGH	[next] Applications using Partial Prerendering with Cache Components are vulnerable to connection exhaustion via crafted POST requests to server actions, causing request-body handling deadlocks that consume server resources and lead to denial of service. A malicious actor can exhaust file descriptors and server capacity, preventing legitimate users from accessing the application.
GHSA-q4gf-8mx6-v5v3	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
GHSA-8h8q-6873-q5fj	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
CVE-2026-29057	MEDIUM	[next] Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger reque...
CVE-2026-44575	MEDIUM	[next] Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment ...
GHSA-w37m-7fhw-fmv9	MEDIUM	[next] A malicious HTTP request can expose compiled source code of Server Functions in affected React packages and frameworks, potentially revealing business logic through information disclosure.
GHSA-wq5f-xc86-pv6w	HIGH	[sharp] A memory vulnerability in the upstream librsvg dependency can lead to remote code execution on glibc-based Linux systems under certain runtime conditions. The vulnerability affects SVG image decoding functionality.

🤖 Remediation details

Fix critical and high-severity vulnerabilities in next and sharp

Short summary

This PR remediates multiple vulnerabilities in two packages — next and sharp — by updating their declared versions in both the root package.json and the packages/demo-nextjs workspace manifest, with yarn.lock refreshed accordingly. The next package was a direct dependency in both locations; sharp was resolved transitively through next and required no separate manifest entry.

next

next was pinned at 15.4.8 in two places: the root package.json (devDependencies) and the packages/demo-nextjs/package.json workspace (dependencies). Both were updated to the exact version 15.5.28, which is the minimum release satisfying every patched-version floor across all nine advisories targeting next in this task. Because the pin was exact (no caret or tilde), Yarn could not resolve a newer version without a manifest edit; updating both manifests and running yarn install --ignore-engines --ignore-scripts from the repo root replaced the stale next@15.4.8 lockfile entry with next@15.5.28.

sharp

sharp was not declared directly in any manifest; it was pulled in as an optionalDependency of next. At next@15.4.8, the declared range for sharp was ^0.34.3, which resolved to 0.34.5 — below the 0.35.5 patched floor. Bumping next to 15.5.28 updated its published optional dependency range for sharp to ^0.34.3 || ^0.35.5, which Yarn resolved to 0.35.5. No direct sharp entry or resolutions override was needed; the fix was entirely a consequence of the next parent bump.

Version changes

Package	From	To	Why updated
next	15.4.8	15.5.28	Direct CVE fix (root package.json devDependencies)
next	15.4.8	15.5.28	Direct CVE fix (packages/demo-nextjs workspace dependencies)
sharp	0.34.5	0.35.5	Transitive CVE fix — resolved via parent bump of next

[pr-auditor]

✅ Security Analysis Results

No security issues found. 3 files reviewed.

---

@pr-auditor rescan to re-run · Powered by Claude Sonnet 5.5 · Docs · #security-engineering-team

[jenkins-tf]

[BOT] Preview available with hash cad734649ae1007d9d43ab839de6236a8909d959 here.