[Aikido] Fix security issue in next via minor version upgrade from 15.4.8 to 15.5.21

[aikido-autofix]

Upgrade Next.js to fix SSRF via WebSocket requests, connection exhaustion DoS, and multiple CPU exhaustion DoS vulnerabilities in App Router endpoints.

✅ Code not affected by breaking changes.

✅ No breaking changes from the Next.js 15.4.8 → 15.5.16 upgrade affect this codebase. The demo-nextjs package uses only basic Next.js features (Pages Router and App Router with standard components) and does not utilize any of the experimental features, MDX, AMP, middleware, or advanced APIs (cookies(), headers()) that are affected by the breaking changes in version 15.5.0.

All breaking changes by upgrading next from version 15.4.8 to 15.5.21 (CHANGELOG)

Version	Description
15.5.0	refactor: rename experimental.dynamicIO to experimental.cacheComponents: #81562
15.5.0	Remove useMDXComponents argument: #80871
15.5.0	Remove experimental.strictNextHead: #81882
15.5.0	[Cache Components] Disallow sync access of cookies & headers at runtime: #82564
15.5.0	Turbopack: set window.next.turbopack instead: #82580
15.5.0	[Deprecation Warnings]: add amp deprecation warning: #82551
15.5.0	[Deprecation Warnings]: add unstable_rootParams deprecation warning: #82582
15.5.0	Stabilize node middleware support: #81907

✅ 7 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-44578	HIGH	[next] A server-side request forgery vulnerability in self-hosted Next.js applications allows attackers to craft WebSocket upgrade requests that proxy arbitrary requests to internal or external destinations, potentially exposing internal services or cloud metadata. Vercel-hosted deployments are unaffected.
CVE-2026-44579	HIGH	[next] Applications using Partial Prerendering with Cache Components are vulnerable to connection exhaustion via crafted POST requests to server actions, causing request-body handling deadlocks that consume server resources and lead to denial of service. Malicious actors can exhaust file descriptors and server capacity, preventing legitimate users from accessing the application.
GHSA-mwv6-3258-q52c	HIGH	[next] A malicious HTTP request to App Router endpoints can cause server deserialization to hang and consume CPU, resulting in denial of service (DoS).
GHSA-q4gf-8mx6-v5v3	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
GHSA-8h8q-6873-q5fj	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
CVE-2026-44575	MEDIUM	[next] Authorization bypass in App Router allows unauthorized access to protected content through transport-specific route variants (.rsc and segment-prefetch URLs) that bypass middleware checks. Attackers can reach protected pages without passing intended authorization validation.
GHSA-w37m-7fhw-fmv9	MEDIUM	[next] A malicious HTTP request can expose compiled source code of Server Functions in affected React packages and frameworks, potentially revealing business logic through information disclosure.

🤖 Remediation details

Upgrade next to patch multiple high/medium severity vulnerabilities

Short summary

This PR remediates multiple high- and medium-severity vulnerabilities in the next package by upgrading it to 15.5.21. The change is applied in two places: the root package.json (devDependencies) and the packages/demo-nextjs workspace member manifest (dependencies). The shared yarn.lock at the repository root is refreshed to resolve a single next entry at the patched version, replacing the previously pinned 15.4.8.

next

next was declared as an exact-pinned direct dependency in both the root package.json (devDependencies) and the packages/demo-nextjs workspace package.json (dependencies), both at 15.4.8. Because Yarn Classic uses a single shared lockfile for the monorepo, both manifest entries had to be updated together; leaving either at 15.4.8 kept a stale lockfile entry for the vulnerable version. The target version 15.5.21 is the smallest 15.x release that satisfies the patched-version floor for all advisories in scope, including CVE-2026-64644 (fixed in 15.5.21) which sits above the intermediate 15.5.16 floor required by the other advisories.

Version changes

Package	From	To	Why updated
next	15.4.8	15.5.21	Direct CVE fix (root devDependencies + packages/demo-nextjs dependencies)

[pr-auditor]

✅ Security Analysis Results

No security issues found. 3 files reviewed.

---

@pr-auditor rescan to re-run · Powered by Claude Sonnet 5 · Docs · #security-engineering-team