fix(security): Fix 10 security issues in next, sharp

[aikido-autofix]

Upgrade Next.js and Sharp to fix critical RCE in AVIF processing and multiple high-severity vulnerabilities including SSRF, DoS, and connection exhaustion attacks. This update includes breaking changes that require manual migration.

⚠️ Code affected by breaking changes.

⚠️ ## Sharp Package - Node.js Version Requirement

Where your code is affected:

• Root package.json (line 5): "node": ">=18"

• packages/embed/package.json (line 11): "node": ">=18"

• packages/embed-react/package.json (line 7): "node": ">=18"

• yarn.lock: Sharp 0.34.5 is currently installed and used as a dependency

Impact:

Sharp 0.35.0+ requires Node.js >= 20.9.0, but your codebase specifies "node": ">=18" in the engines field. This means the project currently supports Node.js 18.x, which will be incompatible with the upgraded sharp version. While sharp is an indirect dependency (installed by Next.js for image optimization), the version mismatch will cause installation or runtime failures on Node.js 18.x environments.

Remediation:

Update the engines.node field in all package.json files to ">=20.9.0" to match sharp's new requirement, and ensure all development, CI/CD, and production environments are running Node.js 20.9.0 or higher.

All breaking changes by upgrading next from version 15.4.8 to 15.5.24 (CHANGELOG)

Version	Description
15.5.0	refactor: rename experimental.dynamicIO to experimental.cacheComponents: #81562
15.5.0	Remove useMDXComponents argument: #80871
15.5.0	Remove experimental.strictNextHead: #81882
15.5.0	[Cache Components] Disallow sync access of cookies & headers at runtime: #82564
15.5.0	Turbopack: set window.next.turbopack instead: #82580
15.5.0	[Deprecation Warnings]: add amp deprecation warning: #82551
15.5.0	[Deprecation Warnings]: add unstable_rootParams deprecation warning: #82582
15.5.0	Stabilize node middleware support: #81907

All breaking changes by upgrading sharp from version 0.34.5 to 0.35.5 (CHANGELOG)

Version	Description
0.35.0	Drop support for Node.js 18, now requires Node.js >= 20.9.0.
0.35.0	Remove install script from package.json file. Compiling from source is now opt-in via the build script.
0.35.0	Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.
0.35.0	Add limitInputChannels with a default value of 5.
0.35.0	Remove deprecated failOnError constructor property.
0.35.0	Remove deprecated paletteBitDepth from metadata response.
0.35.0	Remove deprecated properties from sharpen operation.
0.35.0	Rename format.jp2k as format.jp2 for API consistency.

✅ 10 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-2xp9-vwfh-vxw4	🚨 CRITICAL	[next] A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled.
CVE-2026-44578	HIGH	[next] A server-side request forgery vulnerability in self-hosted Next.js applications allows attackers to craft WebSocket upgrade requests that proxy arbitrary requests to internal or external destinations, potentially exposing internal services or cloud metadata. Vercel-hosted deployments are unaffected.
CVE-2026-44579	HIGH	[next] Applications using Partial Prerendering with Cache Components are vulnerable to connection exhaustion via crafted POST requests to server actions, causing request-body handling deadlocks that consume server resources and lead to denial of service. Malicious actors can exhaust file descriptors and server capacity, preventing legitimate users from accessing the application.
GHSA-h25m-26qc-wcjf	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage, out-of-memory exceptions, or server crashes, resulting in denial of service.
GHSA-mwv6-3258-q52c	HIGH	[next] A malicious HTTP request to App Router endpoints can cause server deserialization to hang and consume CPU, resulting in denial of service (DoS).
GHSA-q4gf-8mx6-v5v3	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
GHSA-8h8q-6873-q5fj	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
CVE-2026-29057	MEDIUM	[next] HTTP request smuggling vulnerability in Next.js rewrites with chunked DELETE/OPTIONS requests allows attackers to bypass route restrictions and access unintended backend endpoints. An attacker could smuggle malicious requests to internal or admin routes through request boundary disagreement between proxy and backend.
GHSA-w37m-7fhw-fmv9	MEDIUM	[next] A malicious HTTP request can expose compiled source code of Server Functions in affected React packages and frameworks, potentially revealing business logic through information disclosure.
GHSA-wq5f-xc86-pv6w	HIGH	[sharp] A memory vulnerability in the upstream librsvg dependency can lead to remote code execution on glibc-based Linux systems under certain runtime conditions. The vulnerability affects SVG image decoding and requires specific runtime conditions to exploit.

🤖 Remediation details

Fix critical and high-severity vulnerabilities in next and sharp

Short summary

This PR remediates multiple vulnerabilities in two packages: next (the direct dependency, carrying the bulk of the CVEs) and sharp (a transitive optional dependency of next). The next version was updated from 15.4.8 to 15.5.24 in both the root package.json and the packages/demo-nextjs/package.json workspace member manifest, which also caused the lockfile to resolve sharp to the patched 0.35.5. The yarn.lock at the repo root reflects all resolved version changes.

next

next was declared as an exact-pinned direct dependency at 15.4.8 in two places: the root package.json (devDependencies) and the packages/demo-nextjs/package.json workspace member (dependencies). Both pins were updated to 15.5.24—the minimum version that satisfies every patched-version floor across all listed advisories—and yarn install was run from the lockfile root to refresh yarn.lock. Because both manifests used the same exact pin, related-package alignment required updating both in the same pass; leaving the workspace member at 15.4.8 would have kept a vulnerable lockfile entry alive.

sharp

sharp is not a direct dependency; it is pulled in as an optional dependency of next. At next@15.4.8, the declared range was ^0.34.3, which resolved to the vulnerable 0.34.5. After bumping next to 15.5.24, that release widens the range to ^0.34.3 || ^0.35.3, which allows Yarn to resolve sharp to 0.35.5—the minimum patched version for GHSA-wq5f-xc86-pv6w. No direct manifest entry for sharp was added; the fix is entirely a consequence of the parent next bump and the resulting lockfile refresh.

Version changes

Package	From	To	Why updated
next	15.4.8	15.5.24	Direct CVE fix (root package.json devDependencies)
next	15.4.8	15.5.24	Direct CVE fix (workspace packages/demo-nextjs/package.json)
sharp	0.34.5	0.35.5	Transitive CVE fix after parent bump (next)
@next/env	15.4.8	15.5.24	Lockfile refresh after next parent bump
@next/swc-linux-x64-gnu	15.4.8	15.5.24	Lockfile refresh after next parent bump
@next/swc-linux-x64-musl	15.4.8	15.5.24	Lockfile refresh after next parent bump
@next/swc-darwin-arm64	15.4.8	15.5.24	Lockfile refresh after next parent bump
@next/swc-darwin-x64	15.4.8	15.5.24	Lockfile refresh after next parent bump
@next/swc-linux-arm64-gnu	15.4.8	15.5.24	Lockfile refresh after next parent bump
@next/swc-linux-arm64-musl	15.4.8	15.5.24	Lockfile refresh after next parent bump
@next/swc-win32-arm64-msvc	15.4.8	15.5.24	Lockfile refresh after next parent bump
@next/swc-win32-x64-msvc	15.4.8	15.5.24	Lockfile refresh after next parent bump
@img/sharp-linux-x64	0.34.5	0.35.5	Lockfile refresh after sharp transitive bump
@img/sharp-linuxmusl-x64	0.34.5	0.35.5	Lockfile refresh after sharp transitive bump
@img/colour	^1.0.0 resolved	^1.1.0 resolved	Lockfile refresh after sharp transitive bump
client-only	not present	0.0.1	New transitive dependency introduced by next@15.5.24

[pr-auditor]

✅ Security Analysis Results

No security issues found. 3 files reviewed.

---

@pr-auditor rescan to re-run · Powered by Claude Sonnet 5.5 · Docs · #security-engineering-team

[jenkins-tf]

[BOT] Preview available with hash 2bd3da2588fa4ce7d1c8ab1d8b7bedefaf090219 here.

[aikido-autofix]

Aikido's automated cron job opened a newer AutoFix. It fixes the same vulnerabilities and more: fix(security): Fix 10 security issues in next, sharp