[Aikido] Fix security issue in next via minor version upgrade from 15.4.8 to 15.5.21

[aikido-autofix]

Upgrade Next.js to fix critical SSRF, DoS, and connection exhaustion vulnerabilities affecting self-hosted and App Router deployments.

✅ Code not affected by breaking changes.

✅ No breaking changes from the Next.js 15.4.8 to 15.5.16 upgrade affect this codebase.

The codebase does not use any of the deprecated or removed features:

• No experimental.dynamicIO or experimental.cacheComponents configuration

• No useMDXComponents usage

• No experimental.strictNextHead configuration

• No cookies() or headers() imports from next/headers

• No window.next.turbopack references

• No AMP configuration

• No unstable_rootParams usage

• No middleware files that would be affected by the node middleware stabilization

The Next.js demo application (packages/demo-nextjs) uses only standard Next.js features like useSearchParams, useRouter, and client components marked with 'use client', none of which are affected by the breaking changes in version 15.5.0.

All breaking changes by upgrading next from version 15.4.8 to 15.5.21 (CHANGELOG)

Version	Description
15.5.0	refactor: rename experimental.dynamicIO to experimental.cacheComponents: #81562
15.5.0	Remove useMDXComponents argument: #80871
15.5.0	Remove experimental.strictNextHead: #81882
15.5.0	[Cache Components] Disallow sync access of cookies & headers at runtime: #82564
15.5.0	Turbopack: set window.next.turbopack instead: #82580
15.5.0	[Deprecation Warnings]: add amp deprecation warning: #82551
15.5.0	[Deprecation Warnings]: add unstable_rootParams deprecation warning: #82582
15.5.0	Stabilize node middleware support: #81907

✅ 6 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-44578	HIGH	[next] A server-side request forgery vulnerability in self-hosted Next.js applications allows attackers to craft WebSocket upgrade requests that proxy arbitrary requests to internal or external destinations, potentially exposing internal services or cloud metadata. Vercel-hosted deployments are unaffected.
CVE-2026-44579	HIGH	[next] Applications using Partial Prerendering with Cache Components are vulnerable to connection exhaustion via crafted POST requests to server actions, causing request-body handling deadlocks that consume server resources and lead to denial of service. Malicious actors can exhaust file descriptors and server capacity, preventing legitimate users from accessing the application.
GHSA-q4gf-8mx6-v5v3	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
GHSA-8h8q-6873-q5fj	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
CVE-2026-44575	MEDIUM	[next] Authorization bypass in App Router allows unauthorized access to protected content through transport-specific route variants (.rsc and segment-prefetch URLs) that bypass middleware checks. Attackers can reach protected pages without passing intended authorization validation.
GHSA-w37m-7fhw-fmv9	MEDIUM	[next] A malicious HTTP request can expose compiled source code of Server Functions in affected React packages and frameworks, potentially revealing business logic through information disclosure.

🤖 Remediation details

Bump next to 15.5.21 to resolve multiple HIGH/MEDIUM security advisories

Short summary

This PR remediates several HIGH and MEDIUM severity vulnerabilities in the next package by updating its pinned version across the repository. The next dependency appears as an exact-version pin in two manifests — the root package.json (devDependencies) and the workspace member packages/demo-nextjs/package.json (dependencies) — and the corresponding resolved entry in yarn.lock was refreshed to match.

next

next was pinned at the exact version 15.4.8 in both the root package.json and packages/demo-nextjs/package.json. All targeted advisories require a minimum of 15.5.21 in the 15.x line (the highest floor among all advisories in scope, set by CVE-2026-64644), so both exact pins were updated to 15.5.21 in a single edit batch and the lockfile was refreshed via yarn install --ignore-engines --ignore-scripts. Because both manifests declared the same exact version, they constitute a related-package group and were moved together to the same target. No resolutions override was needed; the direct manifest bump was sufficient to resolve the patched version in the lockfile.

Version changes

Package	From	To	Why updated
next	15.4.8	15.5.21	Direct CVE fix (root package.json devDependencies + packages/demo-nextjs/package.json dependencies)

[pr-auditor]

✅ Security Analysis Results

No security issues found. 3 files reviewed.

---

@pr-auditor rescan to re-run · Powered by Claude Sonnet 4.6 · Docs · #security-engineering-team