Skip to content

v0.4.8 - Next.js 16.4.3 for two remote code execution advisories and a denial of service

Choose a tag to compare

View all tags
@siracozmen01 siracozmen01 released this 23 Oct 17:39
· 174 commits to main since this release
v0.4.8
dd04e92

A security release. Every site on 0.4.7 or earlier runs a Next.js with two unauthenticated remote code execution advisories and should update now: blysis update, or Admin > Updates. A site pinned to a tag with blysis update <tag> stays on it until you name the new one: blysis update 0.4.8. Nothing to do afterwards. If you run the public image directly, pull ghcr.io/inovixi/blysis:0.4.8.

Next.js 16.4.3

Three advisories published on 2026-10-22 cover next 16.0.0 to 16.4.0 and are fixed from 16.4.1. 0.4.7 shipped 16.4.0; 0.4.8 ships 16.4.3.

  • GHSA-2464-fhr4-w9xw (critical): remote code execution without authentication in the Image Optimization API through SVG files. Blysis allows SVG through the image optimiser, so a stock installation is exposed.
  • GHSA-673q-mjm6-r5xr (critical): remote code execution without authentication in use cache functions that return typed arrays. Neither core nor any module shipped with Blysis uses use cache; a module from elsewhere may.
  • GHSA-p3m5-59mp-jv5r (CVE-2026-94482, high): denial of service in the App Router through Server Actions.

The dependency floor is now ^16.4.3, so no install can resolve an affected version.

Also fixed for security

  • DOMPurify 3.4.17, past GHSA-cg2g-xh64-v4q7 (critical) and two related sanitiser bypasses (GHSA-mrv2-3pqr-j5jr, GHSA-c6gr-qvv4-5v3f). It cleans everything a person writes on the site.
  • The module status list answered anyone who sent an x-internal-request header while INTERNAL_API_SECRET was unset, which is how every install starts. It no longer does.
  • A username belongs to one person however it is capitalised, so nobody can register "Admin" beside "admin". Sign-in, password reset, store gifts and Minecraft linking match names the same way.
  • A payment settles against what the store charged: one for less, or in another currency, is refused and logged, so an edited CoinPayments link can no longer pay a fifty for a cent. A credit top-up credits on every gateway, and shops in yen are charged the price on the page through Stripe and Mollie. These fixes are in the Store and gateway modules.

Backups on Docker

The image never created its backups directory, so on a Docker install no backup was ever written and an update from the panel refused to start unless the box that skips the backup was ticked. 0.4.8 repairs the volume's owner when it starts. If Admin > Updates will not start the update from 0.4.7, run blysis update on the server, or tick the box once; later updates take their backup again.

Other changes

  • A site can follow betas and release candidates, chosen on the update screen.
  • The update screen offers the releases that shipped.
  • A menu on the bar stays open while the pointer moves into it, and chosen radios and checkboxes look chosen in dark mode.

Update the modules the marketplace marks as updated after the core update: Store, Blog, Minecraft Link, Steam Auth and the Stripe, PayPal, Mollie, CoinPayments, Paymentwall and PayTR gateways.

Image

ghcr.io/inovixi/blysis:0.4.8, also tagged 0.4, 0, v0.4.8 and latest.

Assets 2
Loading