You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
A vulnerability affects certain React packages1 for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55182.
The vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76.
All users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately.
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55184.
A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55183.
A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Functions. This could reveal business logic, but would not expose secrets unless they were hardcoded directly into Server Function code.
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and did not fully prevent denial-of-service attacks in all payload types. This affects React package versions 19.0.2, 19.1.3, and 19.2.2 and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-67779.
A malicious HTTP request can be crafted and sent to any Server Function endpoint that, when deserialized, can enter an infinite loop within the React Server Components runtime. This can cause the server process to hang and consume CPU, resulting in denial of service in unpatched environments.
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Two Next.js integration packages have their dependency versions updated: react-next-14 from ^14.2.33 to ^16.0.0 and react-next-15 from ^15.4.8 to ^16.0.0. No code modifications or logic changes are present.
🐰 With whiskers twitching, I hop with glee, Next.js sixteen hops toward thee! From fourteen and fifteen, we make the leap, Dependencies upgraded, promises to keep. 🚀
Pre-merge checks and finishing touches
❌ Failed checks (1 warning)
Check name
Status
Explanation
Resolution
Description check
⚠️ Warning
PR description is auto-generated by Renovate bot and lacks required template sections (Changes, Checklist, Release Impact).
Add the required PR description template sections including explicit Changes summary, Contributing guide checklist, and Release Impact declaration with changeset reference.
✅ Passed checks (2 passed)
Check name
Status
Explanation
Title check
✅ Passed
The title clearly and specifically describes the main change: updating the Next.js dependency to v16.0.9 with a security focus.
Docstring Coverage
✅ Passed
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
✨ Finishing touches
📝 Generate docstrings
🧪 Generate unit tests (beta)
Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch renovate/npm-next-vulnerability
Comment @coderabbitai help to get the list of available commands and usage tips.
An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.
To disable these notifications, a workspace admin can disable them in workspace settings.
dependenciesPull requests that update a dependency file
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
16.0.2->16.0.916.0.7->16.0.9^15.4.8->^16.0.0^14.2.33->^16.0.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
GHSA-9qr9-h5gf-34mp
A vulnerability affects certain React packages1 for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55182.
Fixed in:
React: 19.0.1, 19.1.2, 19.2.1
Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, 15.6.0-canary.58, 16.1.0-canary.12+
The vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76.
All users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately.
1 The affected React packages are:
GHSA-mwv6-3258-q52c
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55184.
A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.
GHSA-w37m-7fhw-fmv9
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55183.
A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Functions. This could reveal business logic, but would not expose secrets unless they were hardcoded directly into Server Function code.
GHSA-5j59-xgg2-r9c4
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and did not fully prevent denial-of-service attacks in all payload types. This affects React package versions 19.0.2, 19.1.3, and 19.2.2 and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-67779.
A malicious HTTP request can be crafted and sent to any Server Function endpoint that, when deserialized, can enter an infinite loop within the React Server Components runtime. This can cause the server process to hang and consume CPU, resulting in denial of service in unpatched environments.
Release Notes
vercel/next.js (next)
v16.0.9Compare Source
v16.0.8Compare Source
v16.0.7Compare Source
v16.0.6Compare Source
v16.0.5Compare Source
Core Changes
Credits
Huge thanks to @lucasadrianof for helping!
v16.0.4Compare Source
v16.0.3Compare Source
Core Changes
next dev --inspect: #85037b4455a6e-20251027to4f931700-20251029: #85518cacheLifetypes out of the webpack plugin and into the dev bundler directly: #85539'use cache'in page/layout component: #855194f931700-20251029to561ee24d-20251101: #85670'next'plugin: #85749561ee24d-20251101to67f7d47a-20251103: #8576267f7d47a-20251103tof646e8ff-20251104: #85772f646e8ff-20251104todd048c3b-20251105: #85819dd048c3b-20251105tofa50caf5-20251107: #85906'use cache'call stacks: #85966fa50caf5-20251107to52684925-20251110: #85980Misc Changes
opt-level = sfor not frequently used crates: #85426experimental.cacheLife: #85467createSandbox: #85507--debug-build-pathsinstead ofNEXT_PRIVATE_APP_PATHS: #85504completion.rsa bit: #84863maxRetriesandhardErrorparameters: #85536cells are created inresolve_rawto make cell allocation order deterministic.: #85525assert*->waitFor*when the util is not instant: #85450RegExp-like implementations incheck: #85537after()tests: #85566test/integration/in flake detection tests: #85590run-for-changescript: #85619extern crateandmacro_usesyntax: #85778NEXT_TEST_PREFER_OFFLINEininstall-native.mjs: #85850next-core/src/next_client_reference/visit_client_reference.rs: #85843non_operation_vc_strongly_consistentfeature usage from next-api: #85874turbo-tasks-macros-sharedcrate intoturbo-tasks-macros: #85917next.browserWithResponse(): #85911'use cache'functions to reduce function allocations: #85904font-familydeclaration: #85913Auth0Link: #85953cacheLife&cacheTagin client: #85872cacheLife&cacheTag: #85875sharpandunrs-resolver: #83168evaluateto take module_graph: #85971encryptActionBoundArgs/decryptActionBoundArgsimports: #86015Credits
Huge thanks to @kdy1, @eps1lon, @SyMind, @bgw, @swarnava, @devjiwonchoi, @ztanner, @ijjk, @huozhi, @icyJoseph, @acdlite, @unstubbable, @gnoff, @gusfune, @vercel-release-bot, @lukesandberg, @sokra, @hayes, @shuding, @wyattjoh, @marjan-ahmed, @timneutkens, @ajstrongdev, @zigang93, @mischnic, @Nayeem-XTREME, @hamirmahal, @eli0shin, @tessamero, @gaojude, @jamesdaniels, @georgesfarah, and @timeyoutakeit for helping!
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.