Skip to content

v1.5.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Sep 11:48
· 49 commits to main since this release
v1.5.6
This tag was signed with the committer’s verified signature.
mattrobinsonsre
SSH Key Fingerprint: IFGyNlxfCbw6q+3Ja0XdM/yJzGiwR4LD4LjQdptX83U
Verified
Learn about vigilant mode.
7be4c0b
This commit was signed with the committer’s verified signature.
mattrobinsonsre
SSH Key Fingerprint: IFGyNlxfCbw6q+3Ja0XdM/yJzGiwR4LD4LjQdptX83U
Verified
Learn about vigilant mode.

A security patch for the 1.6 line, fixing a critical unauthenticated remote code execution reachable through Terrapod's web tier.

Security

  • GHSA-2xp9-vwfh-vxw4 — unauthenticated remote code execution in Next.js image optimization, via AVIF handling. CVSS 9.5 (critical), attack complexity low, privileges required: none. Affects Next.js < 16.3.3; v1.5.5 shipped 16.3.1. Fixed by upgrading to 16.3.3.

This is reachable on a default deployment. The web tier is the only component Terrapod exposes, next/image is used on the login page — which is served before authentication — and there is no images override, so the optimizer is at its enabled default. Upgrade promptly.

GHSA-p293-qw3h-jr36, shipped in the same Next.js release, is remote code execution on a Windows-hosted server. Terrapod publishes linux/amd64 and linux/arm64 images only, so it does not apply here.

Upgrading

A drop-in change: no API, wire-protocol, configuration, Helm-value or database-schema change, and nothing to do but take the new images.

The patch bumps next and eslint-config-next on the release branch and regenerates only what that forces — thirteen packages, all Next's own family plus one transitive, with nothing added or removed. Deliberately not a cherry-pick of main's dependency update, which would have carried four unrelated packages onto a maintenance line.

Status

Stable. 1.6 is the current line; 1.5 receives the same fix as v1.5.6.

Full Changelog: v1.5.5...v1.5.6

Assets 46
Loading