[aikido-autofix]

Upgrade Next.js and Sharp to fix critical RCE vulnerabilities in image optimization (AVIF/libheif), memory corruption, and high-severity DoS/SSRF issues.

✅ Code not affected by breaking changes.

✅ No breaking changes from either the Next.js (15.4.8 => 15.5.28) or sharp (0.34.5 => 0.35.5) upgrades affect this codebase.

Next.js upgrade findings:

• No usage of experimental.dynamicIO or experimental.cacheComponents

• No usage of useMDXComponents

• No usage of experimental.strictNextHead

• No usage of window.next.turbopack

• No usage of unstable_rootParams

• No usage of AMP features

• No usage of cookies() or headers() from next/headers

• No middleware files found

Sharp upgrade findings:

• Sharp is not a dependency in this codebase (not found in any package.json files)

• No imports or usage of sharp library detected

The codebase uses Next.js primarily for the demo application (packages/demo-nextjs) with basic routing and React components, but does not utilize any of the experimental or deprecated features affected by the breaking changes. The Node.js version requirement (>=18) is already compatible with sharp 0.35.x's requirement of >=20.9.0, though sharp is not actually used in this project.

All breaking changes by upgrading next from version 15.4.8 to 15.5.28 (CHANGELOG)

Version	Description
15.5.0	refactor: rename experimental.dynamicIO to experimental.cacheComponents: #81562
15.5.0	Remove useMDXComponents argument: #80871
15.5.0	Remove experimental.strictNextHead: #81882
15.5.0	[Cache Components] Disallow sync access of cookies & headers at runtime: #82564
15.5.0	Turbopack: set window.next.turbopack instead: #82580
15.5.0	[Deprecation Warnings]: add amp deprecation warning: #82551
15.5.0	[Deprecation Warnings]: add unstable_rootParams deprecation warning: #82582
15.5.0	Stabilize node middleware support: #81907

All breaking changes by upgrading sharp from version 0.34.5 to 0.35.5 (CHANGELOG)

Version	Description
0.35.0	Drop support for Node.js 18, now requires Node.js >= 20.9.0.
0.35.0	Remove install script from package.json file. Compiling from source is now opt-in via the build script.
0.35.0	Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.
0.35.0	Add limitInputChannels with a default value of 5.
0.35.0	Remove deprecated failOnError constructor property.
0.35.0	Remove deprecated paletteBitDepth from metadata response.
0.35.0	Remove deprecated properties from sharpen operation.
0.35.0	Rename format.jp2k as format.jp2 for API consistency.

✅ 10 CVEs resolved by this upgrade, including 2 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-2xp9-vwfh-vxw4	🚨 CRITICAL	[next] A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled.
GHSA-2464-fhr4-w9xw	🚨 CRITICAL	[next] A memory-related vulnerability in the upstream Image Optimization library can lead to remote code execution (RCE) on glibc-based Linux systems when processing images.
CVE-2026-44578	HIGH	[next] Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause th...
CVE-2026-44579	HIGH	[next] Applications using Partial Prerendering with Cache Components are vulnerable to connection exhaustion via crafted POST requests to server actions, causing request-body handling deadlocks that consume server resources and lead to denial of service. A malicious actor can exhaust file descriptors and server capacity, preventing legitimate users from accessing the application.
GHSA-q4gf-8mx6-v5v3	HIGH	[next] A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23869](https://github.com/facebook/react/security/...
GHSA-8h8q-6873-q5fj	HIGH	[next] A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react/security/...
CVE-2026-29057	MEDIUM	[next] Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger reque...
CVE-2026-44575	MEDIUM	[next] Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment ...
GHSA-w37m-7fhw-fmv9	MEDIUM	[next] A malicious HTTP request can expose compiled source code of Server Functions in affected React packages and frameworks, potentially revealing business logic through information disclosure.
GHSA-wq5f-xc86-pv6w	HIGH	[sharp] A memory vulnerability in the upstream librsvg dependency can lead to remote code execution on glibc-based Linux systems under certain runtime conditions. The vulnerability affects SVG image decoding functionality.

🤖 Remediation details

Fix critical and high-severity vulnerabilities in next and sharp

Short summary

This PR remediates multiple vulnerabilities in two packages: next (the direct dependency) and sharp (a transitive dependency pulled in by next). The fix updates the exact-pinned next version in both the root package.json and the packages/demo-nextjs workspace package.json from 15.4.8 to 15.5.28, which also causes sharp to resolve to the patched version 0.35.5 in yarn.lock.

next

next is declared as an exact pin (15.4.8) in two places: the root package.json (devDependencies) and the packages/demo-nextjs workspace package.json (dependencies). Both pins were updated to 15.5.28 — the minimum version that satisfies every advisory's patched-version floor across the full set of CVEs targeting this package. Because both manifests carried the identical exact pin 15.4.8, they form a related-package alignment group and move together to the same target. The yarn.lock was refreshed via yarn install --ignore-engines --ignore-scripts from the repo root, collapsing the previously split lockfile entries into a single next@15.5.28 resolution.

sharp

sharp is a transitive-only optional dependency; it is not declared in any project manifest directly. It was previously resolved to 0.34.5 under next@15.4.8's ^0.34.3 range, which does not admit 0.35.5. Upgrading next to 15.5.28 caused next's published optional-dependency spec for sharp to widen to ^0.34.3 || ^0.35.5, which Yarn then resolved to 0.35.5 — the minimum patched version — during the same lockfile refresh. No resolutions override was required.

Version changes

Package	From	To	Why updated
next	15.4.8 (exact, root package.json)	15.5.28	Direct CVE fix — root manifest
next	15.4.8 (exact, packages/demo-nextjs/package.json)	15.5.28	Direct CVE fix — workspace manifest (related package alignment)
sharp	0.34.5 (lockfile)	0.35.5	Transitive CVE fix — semver resolution after parent bump of next

[pr-auditor]

✅ Security Analysis Results

No security issues found. 3 files reviewed.

---

@pr-auditor rescan to re-run · Powered by Claude Sonnet 5.5 · Docs · #security-engineering-team

[jenkins-tf]

[BOT] Preview available with hash cce9a7d1589d7bda08c145ef820ce635935f8c5b here.