fix(security): Fix 8 security issues in next, sharp

[aikido-autofix]

Upgrade Next.js and Sharp to fix critical RCE in AVIF processing, SSRF via WebSocket requests, connection exhaustion DoS, and CPU exhaustion DoS in Server Components.

✅ Code not affected by breaking changes.

✅ No breaking changes from either package upgrade affect this codebase.

Next.js (15.4.8 => 15.5.24):

• The codebase does not use any of the deprecated or changed features:

  • No experimental.dynamicIO or experimental.cacheComponents configuration found

  • No useMDXComponents usage

  • No experimental.strictNextHead configuration

  • No synchronous access to cookies() or headers() in server components

  • No window.next.version references (Turbopack change)

  • No AMP configuration

  • No unstable_rootParams usage

• The demo-nextjs package uses only basic Next.js features (pages router and app router with client components)

Sharp (0.34.5 => 0.35.5):

• Sharp is installed as a transitive dependency through Next.js (visible in yarn.lock)

• The codebase does not directly import or use sharp

• Node.js version requirement is already >=18 in package.json, but sharp 0.35.0 requires >=20.9.0, which could cause issues if running on Node.js 18.x

• However, since sharp is only used internally by Next.js for image optimization and not directly by the application code, and there are no direct usages of deprecated sharp APIs (failOnError, paletteBitDepth, sharpen properties, format.jp2k), the upgrade should not break existing functionality

Note: While the sharp upgrade requires Node.js >= 20.9.0, this is a runtime environment requirement rather than a code-breaking change. The project's current node: ">=18" engine specification should be updated to ">=20.9.0" to align with sharp's requirements.

All breaking changes by upgrading next from version 15.4.8 to 15.5.24 (CHANGELOG)

Version	Description
15.5.0	refactor: rename experimental.dynamicIO to experimental.cacheComponents: #81562
15.5.0	Remove useMDXComponents argument: #80871
15.5.0	Remove experimental.strictNextHead: #81882
15.5.0	[Cache Components] Disallow sync access of cookies & headers at runtime: #82564
15.5.0	Turbopack: set window.next.turbopack instead: #82580
15.5.0	[Deprecation Warnings]: add amp deprecation warning: #82551
15.5.0	[Deprecation Warnings]: add unstable_rootParams deprecation warning: #82582
15.5.0	Stabilize node middleware support: #81907

All breaking changes by upgrading sharp from version 0.34.5 to 0.35.5 (CHANGELOG)

Version	Description
0.35.0	Drop support for Node.js 18, now requires Node.js >= 20.9.0.
0.35.0	Remove install script from package.json file. Compiling from source is now opt-in via the build script.
0.35.0	Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.
0.35.0	Add limitInputChannels with a default value of 5.
0.35.0	Remove deprecated failOnError constructor property.
0.35.0	Remove deprecated paletteBitDepth from metadata response.
0.35.0	Remove deprecated properties from sharpen operation.
0.35.0	Rename format.jp2k as format.jp2 for API consistency.

✅ 8 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-2xp9-vwfh-vxw4	🚨 CRITICAL	[next] A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled.
CVE-2026-44578	HIGH	[next] A server-side request forgery vulnerability in self-hosted Next.js applications allows attackers to craft WebSocket upgrade requests that proxy arbitrary requests to internal or external destinations, potentially exposing internal services or cloud metadata. Vercel-hosted deployments are unaffected.
CVE-2026-44579	HIGH	[next] Applications using Partial Prerendering with Cache Components are vulnerable to connection exhaustion via crafted POST requests to server actions, causing request-body handling deadlocks that consume server resources and lead to denial of service. Malicious actors can exhaust file descriptors and server capacity, preventing legitimate users from accessing the application.
GHSA-q4gf-8mx6-v5v3	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
GHSA-8h8q-6873-q5fj	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
CVE-2026-29057	MEDIUM	[next] HTTP request smuggling vulnerability in Next.js rewrites with chunked DELETE/OPTIONS requests allows attackers to bypass route restrictions and access unintended backend endpoints. An attacker could smuggle malicious requests to internal or admin routes through request boundary disagreement between proxy and backend.
GHSA-w37m-7fhw-fmv9	MEDIUM	[next] A malicious HTTP request can expose compiled source code of Server Functions in affected React packages and frameworks, potentially revealing business logic through information disclosure.
GHSA-wq5f-xc86-pv6w	HIGH	[sharp] A memory vulnerability in the upstream librsvg dependency can lead to remote code execution on glibc-based Linux systems under certain runtime conditions. The vulnerability affects SVG image decoding and requires specific runtime conditions to exploit.

🤖 Remediation details

Fix critical and high-severity vulnerabilities in next and sharp

Short summary

This PR remediates multiple vulnerabilities in two packages: next (seven advisories, ranging from medium to critical severity) and sharp (one high-severity advisory). The fix updates the exact-pinned next version in both the root package.json and the packages/demo-nextjs workspace member manifest, which also causes the transitive sharp dependency to resolve to a patched version. The yarn.lock lockfile is refreshed accordingly, removing all stale resolution entries for both packages.

next

next was pinned exactly at 15.4.8 in both the root package.json and the packages/demo-nextjs workspace package.json. All seven advisories against next required a minimum of 15.5.24 to be fully resolved, so both manifests were updated to that version. Because next was an exact pin (no caret or tilde), Yarn retained the old next@15.4.8 lockfile entry until the workspace manifest was also updated; once both declarations pointed to 15.5.24, the stale entry was removed and the lockfile converged to a single resolved instance at 15.5.24.

sharp

sharp is a transitive optional dependency pulled in by next. Under next@15.4.8, the declared range was ^0.34.3, which resolved to 0.34.5 — a version vulnerable to GHSA-wq5f-xc86-pv6w. Bumping next to 15.5.24 widened its declared range for sharp to ^0.34.3 || ^0.35.3, which allowed Yarn to resolve sharp to 0.35.5 (the patched version) without any direct manifest entry or override for sharp itself.

Version changes

Package	From	To	Why updated
next	15.4.8 (root package.json)	15.5.24	Direct CVE fix
next	15.4.8 (packages/demo-nextjs/package.json)	15.5.24	Related package alignment (same exact-pin group)
sharp	0.34.5 (lockfile)	0.35.5	Transitive CVE fix after parent bump (next)
@next/env	15.4.8 (lockfile)	15.5.24	Lockfile refresh after next parent bump
@next/swc-linux-x64-gnu	15.4.8 (lockfile)	15.5.24	Lockfile refresh after next parent bump
@next/swc-linux-x64-musl	15.4.8 (lockfile)	15.5.24	Lockfile refresh after next parent bump
@img/sharp-linux-x64	0.34.5 (lockfile)	0.35.5	Lockfile refresh after next parent bump
@img/sharp-linuxmusl-x64	0.34.5 (lockfile)	0.35.5	Lockfile refresh after next parent bump
@img/colour	—	1.1.0	New transitive dependency introduced by sharp@0.35.5

[pr-auditor]

✅ Security Analysis Results

No security issues found. 3 files reviewed.

---

@pr-auditor rescan to re-run · Powered by Claude Sonnet 5.5 · Docs · #security-engineering-team

[jenkins-tf]

[BOT] Preview available with hash 47bdf31d305d3c18527c33a812b96995b9a63640 here.