[Aikido] Fix security issue in next via minor version upgrade from 15.4.8 to 15.5.21

[aikido-autofix]

Upgrade Next.js to fix critical SSRF, DoS, and connection exhaustion vulnerabilities affecting self-hosted servers and App Router applications.

✅ Code not affected by breaking changes.

✅ No breaking changes from the Next.js 15.4.8 to 15.5.16 upgrade affect this codebase.

The codebase contains a Next.js demo application (packages/demo-nextjs) that uses basic Next.js features like the App Router, client components, and navigation hooks. However, none of the deprecated or removed features from version 15.5.0 are present:

• No experimental.dynamicIO or experimental.cacheComponents configuration

• No useMDXComponents usage

• No experimental.strictNextHead configuration

• No synchronous cookies() or headers() calls in server components

• No AMP configuration

• No unstable_rootParams usage

• No custom middleware that would be affected by the node middleware stabilization

The upgrade can proceed safely without any code changes required.

All breaking changes by upgrading next from version 15.4.8 to 15.5.21 (CHANGELOG)

Version	Description
15.5.0	refactor: rename experimental.dynamicIO to experimental.cacheComponents: #81562
15.5.0	Remove useMDXComponents argument: #80871
15.5.0	Remove experimental.strictNextHead: #81882
15.5.0	[Cache Components] Disallow sync access of cookies & headers at runtime: #82564
15.5.0	Turbopack: set window.next.turbopack instead: #82580
15.5.0	[Deprecation Warnings]: add amp deprecation warning: #82551
15.5.0	[Deprecation Warnings]: add unstable_rootParams deprecation warning: #82582
15.5.0	Stabilize node middleware support: #81907

✅ 6 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-44578	HIGH	[next] Self-hosted applications are vulnerable to server-side request forgery (SSRF) through crafted WebSocket upgrade requests, allowing attackers to proxy requests to arbitrary destinations and potentially expose internal services or cloud metadata. Vercel-hosted deployments are unaffected.
CVE-2026-44579	HIGH	[next] Applications using Partial Prerendering with Cache Components are vulnerable to connection exhaustion via crafted POST requests to server actions, causing request-body handling deadlocks that consume server resources and lead to denial of service. Malicious actors can exhaust file descriptors and server capacity, preventing legitimate users from accessing the application.
GHSA-q4gf-8mx6-v5v3	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
GHSA-8h8q-6873-q5fj	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
CVE-2026-44575	MEDIUM	[next] Authorization bypass in App Router allows unauthorized access to protected content through transport-specific route variants (.rsc and segment-prefetch URLs) that bypass middleware checks. Attackers can reach protected pages without proper authorization verification.
GHSA-w37m-7fhw-fmv9	MEDIUM	[next] A malicious HTTP request can expose compiled source code of Server Functions in affected React packages and frameworks, potentially revealing business logic through information disclosure.

🤖 Remediation details

Fix Next.js security vulnerabilities: bump next from 15.4.8 → 15.5.21

Short summary

This PR remediates multiple high- and medium-severity vulnerabilities in the next package by upgrading it from 15.4.8 to 15.5.21. The change is applied in two places: the root package.json (devDependencies) and the packages/demo-nextjs/package.json workspace manifest, both of which carried an exact pin on the vulnerable version. The yarn.lock lockfile is refreshed accordingly, resolving to a single clean next@15.5.21 entry with no stale duplicates.

next

next is declared as a direct exact-pinned dependency in both the root package.json (devDependencies) and the packages/demo-nextjs workspace manifest (dependencies). Both pins were updated from 15.4.8 to 15.5.21 in a single edit batch, followed by a yarn install --ignore-engines --ignore-scripts refresh from the lockfile root. The target version 15.5.21 is the smallest release that satisfies the patched-version floor for all advisories in scope, including CVE-2026-64644 (which requires ≥ 15.5.21 and was introduced as a new finding after an intermediate upgrade to 15.5.16). No resolutions overrides were needed.

Version changes

Package	From	To	Why updated
next (root package.json)	15.4.8	15.5.21	Direct CVE fix
next (packages/demo-nextjs/package.json)	15.4.8	15.5.21	Direct CVE fix — workspace pin aligned with root
@next/env	15.4.8	15.5.21	Lockfile refresh — sibling package distributed with next
@next/swc-linux-x64-gnu	15.4.8	15.5.21	Lockfile refresh — sibling package distributed with next
@next/swc-linux-x64-musl	15.4.8	15.5.21	Lockfile refresh — sibling package distributed with next

[gitstream-cm]

🚨 gitStream Monthly Automation Limit Reached 🚨

Your organization has exceeded the number of pull requests allowed for automation with gitStream.
Monthly PRs automated: 250/250

To continue automating your PR workflows and unlock additional features, please contact LinearB.

[pr-auditor]

✅ Security Analysis Results

Great news! No security issues found in this pull request.

Analysis Summary:

• 📁 Files reviewed: 3
• ✅ No security vulnerabilities detected

---

💡 Trigger a new security scan by commenting @pr-auditor rescan on this PR.

Security analysis powered by Claude Sonnet 4.6 via pr-auditor | Questions? Contact #dx-team or check out this page