chore(deps): update dependency next to v16.1.7 [security]#8344
Merged
renovate[bot] merged 1 commit intomainfrom Mar 18, 2026
Merged
chore(deps): update dependency next to v16.1.7 [security]#8344renovate[bot] merged 1 commit intomainfrom
renovate[bot] merged 1 commit intomainfrom
Conversation
|
Size Change: -10 B (0%) Total Size: 461 kB
ℹ️ View Unchanged
|
Pull Request Test Coverage Report for Build 23215946877Details
💛 - Coveralls |
Lukas742
approved these changes
Mar 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
16.1.6→16.1.7GitHub Vulnerability Alerts
CVE-2026-27977
Summary
In
next dev, cross-site protection for internal websocket endpoints could treatOrigin: nullas a bypass case even ifallowedDevOriginsis configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly.Impact
If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only.
Apps without a configured
allowedDevOriginsstill allow connections from any origin.Patches
Fixed by validating
Origin: nullthrough the same cross-site origin-allowance checks used for other origins.Workarounds
If upgrade is not immediately possible:
next devto untrusted networks./_next/webpack-hmrwhenOriginisnullat your proxy.CVE-2026-27978
Summary
origin: nullwas treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests.Impact
An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF).
Patches
Fixed by treating
'null'as an explicit origin value and enforcing host/origin checks unless'null'is explicitly allowlisted inexperimental.serverActions.allowedOrigins.Workarounds
If upgrade is not immediately possible:
SameSite=Stricton sensitive auth cookies.'null'inserverActions.allowedOriginsunless intentionally required and additionally protected.CVE-2026-27979
Summary
A request containing the
next-resume: 1header (corresponding with a PPR resume request) would buffer request bodies without consistently enforcingmaxPostponedStateSizein certain setups. The previous mitigation protected minimal-mode deployments, but equivalent non-minimal deployments remained vulnerable to the same unbounded postponed resume-body buffering behavior.Impact
In applications using the App Router with Partial Prerendering capability enabled (via
experimental.pprorcacheComponents), an attacker could send oversizednext-resumePOST payloads that were buffered without consistent size enforcement in non-minimal deployments, causing excessive memory usage and potential denial of service.Patches
Fixed by enforcing size limits across all postponed-body buffering paths and erroring when limits are exceeded.
Workarounds
If upgrade is not immediately possible:
next-resumeheader, as this is never valid to be sent from an untrusted client.CVE-2026-29057
Summary
When Next.js rewrites proxy traffic to an external backend, a crafted
DELETE/OPTIONSrequest usingTransfer-Encoding: chunkedcould trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.
Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so
content-length: 0is added only when bothcontent-lengthandtransfer-encodingare absent, andtransfer-encodingis no longer removed in that code path.Workarounds
If upgrade is not immediately possible:
DELETE/OPTIONSrequests on rewritten routes at your edge/proxy.Release Notes
vercel/next.js (next)
v16.1.7Compare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.