Skip to content

Bump next from 16.0.10 to 16.1.5 - #69

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/next-16.1.5
Open

Bump next from 16.0.10 to 16.1.5#69
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/next-16.1.5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jan 27, 2026

Copy link
Copy Markdown

Bumps next from 16.0.10 to 16.1.5.

Release notes

Sourced from next's releases.

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.1.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Only filter next config if experimental flag is enabled (#88733)

Credits

Huge thanks to @​mischnic for helping!

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

v16.1.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Turbopack: Update to swc_core v50.2.3 (#87841) (#88296)
    • Fixes a crash when processing mdx files with multibyte characters. (#87713)
  • Turbopack: mimalloc upgrade and enabling it on musl (#88503) (#87815) (#88426)
    • Fixes a significant performance issue on musl-based Linux distributions (e.g. Alpine in Docker) related to musl's allocator.
    • Other platforms have always used mimalloc, but we previously did not use mimalloc on musl because of compilation issues that have since been resolved.

Credits

Huge thanks to @​mischnic for helping!

v16.1.1

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

... (truncated)

Commits
  • acba4a6 v16.1.5
  • e1d1fc6 Add maximum size limit for postponed body parsing (#88175)
  • 500ec83 fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
  • 1caaca3 feat(next/image)!: add images.maximumResponseBody config (#88183)
  • 522ed84 Sync DoS mitigations for React Flight
  • 8cad197 [backport][cna] Ensure created app is not considered the workspace root in pn...
  • 2718661 Backport/docs fixes (#89031)
  • 5333625 Backport/docs fixes 16.1.5 (#88916)
  • 60de6c2 v16.1.4
  • 5f75d22 backport: Only filter next config if experimental flag is enabled (#88733) (#...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [next](https://github.com/vercel/next.js) from 16.0.10 to 16.1.5.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.0.10...v16.1.5)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.1.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 27, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner January 27, 2026 21:39
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 27, 2026
@priyadarshan-khadtale-cstk
priyadarshan-khadtale-cstk force-pushed the dependabot/npm_and_yarn/next-16.1.5 branch from 3747f1a to 799e8f5 Compare August 13, 2026 09:55
@snyk-io

snyk-io Bot commented Aug 13, 2026

Copy link
Copy Markdown

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 1 0 10 ✅ Passed
🟠 High Severity 27 0 25 ❌ Failed
🟡 Medium Severity 40 0 500 ✅ Passed
🔵 Low Severity 7 0 1000 ✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 1 0 15 / 30 days ❌ Failed
🟠 High 17 0 30 / 120 days ❌ Failed
🟡 Medium 21 0 90 / 365 days ❌ Failed
🔵 Low 0 0 180 / 365 days ✅ Passed

🔴 Critical Severity - SLA Breached Issues (with fixes)

Showing 1 issue(s) that have exceeded the 15-day SLA threshold:

  1. CRLF Injection
    • ID: SNYK-JS-UNDICI-17372658
    • Package: undici@7.16.0
    • Published: 55 days ago (SLA: 15 days)
    • CVSS Score: 9.2
    • CVE: CVE-2026-9679

🟠 High Severity - SLA Breached Issues (with fixes)

Showing 17 issue(s) that have exceeded the 30-day SLA threshold:

  1. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-QS-15268416
    • Package: qs@6.14.1
    • Published: 182 days ago (SLA: 30 days)
    • CVSS Score: 8.2
    • CVE: CVE-2026-2391
  2. Uncaught Exception

    • ID: SNYK-JS-UNDICI-15518064
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-1528
  3. Improper Handling of Highly Compressed Data (Data Amplification)

    • ID: SNYK-JS-UNDICI-15518068
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-1526
  4. Uncaught Exception

    • ID: SNYK-JS-UNDICI-15518070
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-2229
  5. Arbitrary Code Injection

    • ID: SNYK-JS-LODASHES-15869627
    • Package: lodash-es@4.17.21
    • Published: 133 days ago (SLA: 30 days)
    • CVSS Score: 8.6
    • CVE: CVE-2026-4800
  6. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-15954202
    • Package: next@16.1.5
    • Published: 125 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-23869
  7. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-16638674
    • Package: next@16.1.5
    • Published: 93 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-23870
  8. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-16638678
    • Package: next@16.1.5
    • Published: 93 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-44579
  9. Authentication Bypass Using an Alternate Path or Channel

    • ID: SNYK-JS-NEXT-16638679
    • Package: next@16.1.5
    • Published: 93 days ago (SLA: 30 days)
    • CVSS Score: 8.6
    • CVE: CVE-2026-44574
  10. Allocation of Resources Without Limits or Throttling

  • ID: SNYK-JS-NEXT-16638680
  • Package: next@16.1.5
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.2
  • CVE: CVE-2026-44577
  1. Server-side Request Forgery (SSRF)
  • ID: SNYK-JS-NEXT-16638682
  • Package: next@16.1.5
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 7.7
  • CVE: CVE-2026-44578
  1. Incorrect Authorization
  • ID: SNYK-JS-NEXT-16638683
  • Package: next@16.1.5
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.2
  • CVE: CVE-2026-44573
  1. Authentication Bypass Using an Alternate Path or Channel
  • ID: SNYK-JS-NEXT-16638685
  • Package: next@16.1.5
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.7
  • CVE: CVE-2026-44575
  1. Authentication Bypass Using an Alternate Path or Channel
  • ID: SNYK-JS-NEXT-16638686
  • Package: next@16.1.5
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.7
  • CVE: CVE-2026-45109
  1. Use of Cache Containing Sensitive Information
  • ID: SNYK-JS-UNDICI-17372697
  • Package: undici@7.16.0
  • Published: 55 days ago (SLA: 30 days)
  • CVSS Score: 8.9
  • CVE: CVE-2026-9678
  1. Allocation of Resources Without Limits or Throttling
  • ID: SNYK-JS-UNDICI-17372754
  • Package: undici@7.16.0
  • Published: 55 days ago (SLA: 30 days)
  • CVSS Score: 8.7
  • CVE: CVE-2026-12151
  1. Permissive List of Allowed Inputs
  • ID: SNYK-JS-UNDICI-17372758
  • Package: undici@7.16.0
  • Published: 55 days ago (SLA: 30 days)
  • CVSS Score: 8.3
  • CVE: CVE-2026-11525

🟡 Medium Severity - SLA Breached Issues (with fixes)

Showing 20 issue(s) that have exceeded the 90-day SLA threshold:

  1. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-UNDICI-14943963
    • Package: undici@7.16.0
    • Published: 209 days ago (SLA: 90 days)
    • CVSS Score: 5.3
    • CVE: CVE-2026-22036
  2. Prototype Pollution

    • ID: SNYK-JS-LODASHES-15053836
    • Package: lodash-es@4.17.21
    • Published: 203 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2025-13465
  3. Cross-site Scripting (XSS)

    • ID: SNYK-JS-DOMPURIFY-15371376
    • Package: dompurify@3.3.0
    • Published: 161 days ago (SLA: 90 days)
    • CVSS Score: 5.1
    • CVE: CVE-2026-0540
  4. HTTP Request Smuggling

    • ID: SNYK-JS-UNDICI-15518061
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2026-1525
  5. CRLF Injection

    • ID: SNYK-JS-UNDICI-15518072
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 90 days)
    • CVSS Score: 5.1
    • CVE: CVE-2026-1527
  6. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-15674556
    • Package: next@16.1.5
    • Published: 148 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2026-27980
  7. Cross-site Request Forgery (CSRF)

    • ID: SNYK-JS-NEXT-15674557
    • Package: next@16.1.5
    • Published: 148 days ago (SLA: 90 days)
    • CVSS Score: 5.3
    • CVE: CVE-2026-27978
  8. HTTP Request Smuggling

    • ID: SNYK-JS-NEXT-15674558
    • Package: next@16.1.5
    • Published: 148 days ago (SLA: 90 days)
    • CVSS Score: 6.3
    • CVE: CVE-2026-29057
  9. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-15674559
    • Package: next@16.1.5
    • Published: 148 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2026-27979
  10. Cross-site Scripting (XSS)

  • ID: SNYK-JS-DOMPURIFY-15810938
  • Package: dompurify@3.3.0
  • Published: 136 days ago (SLA: 90 days)
  • CVSS Score: 5.3
  • CVE: CVE-2026-65914
  1. Prototype Pollution
  • ID: SNYK-JS-LODASHES-15869621
  • Package: lodash-es@4.17.21
  • Published: 133 days ago (SLA: 90 days)
  • CVSS Score: 6.9
  • CVE: CVE-2026-2950
  1. Prototype Pollution
  • ID: SNYK-JS-DOMPURIFY-15874903
  • Package: dompurify@3.3.0
  • Published: 132 days ago (SLA: 90 days)
  • CVSS Score: 5.3
  • CVE: CVE-2026-65913
  1. Permissive List of Allowed Inputs
  • ID: SNYK-JS-DOMPURIFY-15874905
  • Package: dompurify@3.3.0
  • Published: 132 days ago (SLA: 90 days)
  • CVSS Score: 5.3
  • CVE: CVE-2026-65912
  1. Operator Precedence Logic Error
  • ID: SNYK-JS-DOMPURIFY-16078387
  • Package: dompurify@3.3.0
  • Published: 119 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-41240
  1. Cross-site Scripting (XSS)
  • ID: SNYK-JS-DOMPURIFY-16132234
  • Package: dompurify@3.3.0
  • Published: 112 days ago (SLA: 90 days)
  • CVSS Score: 5.1
  • CVE: CVE-2026-41238
  1. Improper Validation of Specified Index, Position, or Offset in Input
  • ID: SNYK-JS-UUID-16133035
  • Package: uuid@8.3.2
  • Published: 112 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-41907
  1. Cross-site Scripting (XSS)
  • ID: SNYK-JS-POSTCSS-16189065
  • Package: postcss@8.4.31
  • Published: 111 days ago (SLA: 90 days)
  • CVSS Score: 5.3
  • CVE: CVE-2026-41305
  1. Acceptance of Extraneous Untrusted Data With Trusted Data
  • ID: SNYK-JS-NEXT-16638675
  • Package: next@16.1.5
  • Published: 93 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-44572
  1. Interpretation Conflict
  • ID: SNYK-JS-NEXT-16638676
  • Package: next@16.1.5
  • Published: 93 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-44576
  1. Use of Weak Hash
  • ID: SNYK-JS-NEXT-16638677
  • Package: next@16.1.5
  • Published: 93 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-44582

❌ BUILD FAILED - Security checks failed

Please review and fix the security vulnerabilities before merging.

1 similar comment
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 1 0 10 ✅ Passed
🟠 High Severity 27 0 25 ❌ Failed
🟡 Medium Severity 40 0 500 ✅ Passed
🔵 Low Severity 7 0 1000 ✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 1 0 15 / 30 days ❌ Failed
🟠 High 17 0 30 / 120 days ❌ Failed
🟡 Medium 21 0 90 / 365 days ❌ Failed
🔵 Low 0 0 180 / 365 days ✅ Passed

🔴 Critical Severity - SLA Breached Issues (with fixes)

Showing 1 issue(s) that have exceeded the 15-day SLA threshold:

  1. CRLF Injection
    • ID: SNYK-JS-UNDICI-17372658
    • Package: undici@7.16.0
    • Published: 55 days ago (SLA: 15 days)
    • CVSS Score: 9.2
    • CVE: CVE-2026-9679

🟠 High Severity - SLA Breached Issues (with fixes)

Showing 17 issue(s) that have exceeded the 30-day SLA threshold:

  1. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-QS-15268416
    • Package: qs@6.14.1
    • Published: 182 days ago (SLA: 30 days)
    • CVSS Score: 8.2
    • CVE: CVE-2026-2391
  2. Uncaught Exception

    • ID: SNYK-JS-UNDICI-15518064
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-1528
  3. Improper Handling of Highly Compressed Data (Data Amplification)

    • ID: SNYK-JS-UNDICI-15518068
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-1526
  4. Uncaught Exception

    • ID: SNYK-JS-UNDICI-15518070
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-2229
  5. Arbitrary Code Injection

    • ID: SNYK-JS-LODASHES-15869627
    • Package: lodash-es@4.17.21
    • Published: 133 days ago (SLA: 30 days)
    • CVSS Score: 8.6
    • CVE: CVE-2026-4800
  6. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-15954202
    • Package: next@16.1.5
    • Published: 125 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-23869
  7. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-16638674
    • Package: next@16.1.5
    • Published: 93 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-23870
  8. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-16638678
    • Package: next@16.1.5
    • Published: 93 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-44579
  9. Authentication Bypass Using an Alternate Path or Channel

    • ID: SNYK-JS-NEXT-16638679
    • Package: next@16.1.5
    • Published: 93 days ago (SLA: 30 days)
    • CVSS Score: 8.6
    • CVE: CVE-2026-44574
  10. Allocation of Resources Without Limits or Throttling

  • ID: SNYK-JS-NEXT-16638680
  • Package: next@16.1.5
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.2
  • CVE: CVE-2026-44577
  1. Server-side Request Forgery (SSRF)
  • ID: SNYK-JS-NEXT-16638682
  • Package: next@16.1.5
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 7.7
  • CVE: CVE-2026-44578
  1. Incorrect Authorization
  • ID: SNYK-JS-NEXT-16638683
  • Package: next@16.1.5
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.2
  • CVE: CVE-2026-44573
  1. Authentication Bypass Using an Alternate Path or Channel
  • ID: SNYK-JS-NEXT-16638685
  • Package: next@16.1.5
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.7
  • CVE: CVE-2026-44575
  1. Authentication Bypass Using an Alternate Path or Channel
  • ID: SNYK-JS-NEXT-16638686
  • Package: next@16.1.5
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.7
  • CVE: CVE-2026-45109
  1. Use of Cache Containing Sensitive Information
  • ID: SNYK-JS-UNDICI-17372697
  • Package: undici@7.16.0
  • Published: 55 days ago (SLA: 30 days)
  • CVSS Score: 8.9
  • CVE: CVE-2026-9678
  1. Allocation of Resources Without Limits or Throttling
  • ID: SNYK-JS-UNDICI-17372754
  • Package: undici@7.16.0
  • Published: 55 days ago (SLA: 30 days)
  • CVSS Score: 8.7
  • CVE: CVE-2026-12151
  1. Permissive List of Allowed Inputs
  • ID: SNYK-JS-UNDICI-17372758
  • Package: undici@7.16.0
  • Published: 55 days ago (SLA: 30 days)
  • CVSS Score: 8.3
  • CVE: CVE-2026-11525

🟡 Medium Severity - SLA Breached Issues (with fixes)

Showing 20 issue(s) that have exceeded the 90-day SLA threshold:

  1. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-UNDICI-14943963
    • Package: undici@7.16.0
    • Published: 209 days ago (SLA: 90 days)
    • CVSS Score: 5.3
    • CVE: CVE-2026-22036
  2. Prototype Pollution

    • ID: SNYK-JS-LODASHES-15053836
    • Package: lodash-es@4.17.21
    • Published: 203 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2025-13465
  3. Cross-site Scripting (XSS)

    • ID: SNYK-JS-DOMPURIFY-15371376
    • Package: dompurify@3.3.0
    • Published: 161 days ago (SLA: 90 days)
    • CVSS Score: 5.1
    • CVE: CVE-2026-0540
  4. HTTP Request Smuggling

    • ID: SNYK-JS-UNDICI-15518061
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2026-1525
  5. CRLF Injection

    • ID: SNYK-JS-UNDICI-15518072
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 90 days)
    • CVSS Score: 5.1
    • CVE: CVE-2026-1527
  6. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-15674556
    • Package: next@16.1.5
    • Published: 148 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2026-27980
  7. Cross-site Request Forgery (CSRF)

    • ID: SNYK-JS-NEXT-15674557
    • Package: next@16.1.5
    • Published: 148 days ago (SLA: 90 days)
    • CVSS Score: 5.3
    • CVE: CVE-2026-27978
  8. HTTP Request Smuggling

    • ID: SNYK-JS-NEXT-15674558
    • Package: next@16.1.5
    • Published: 148 days ago (SLA: 90 days)
    • CVSS Score: 6.3
    • CVE: CVE-2026-29057
  9. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-15674559
    • Package: next@16.1.5
    • Published: 148 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2026-27979
  10. Cross-site Scripting (XSS)

  • ID: SNYK-JS-DOMPURIFY-15810938
  • Package: dompurify@3.3.0
  • Published: 136 days ago (SLA: 90 days)
  • CVSS Score: 5.3
  • CVE: CVE-2026-65914
  1. Prototype Pollution
  • ID: SNYK-JS-LODASHES-15869621
  • Package: lodash-es@4.17.21
  • Published: 133 days ago (SLA: 90 days)
  • CVSS Score: 6.9
  • CVE: CVE-2026-2950
  1. Prototype Pollution
  • ID: SNYK-JS-DOMPURIFY-15874903
  • Package: dompurify@3.3.0
  • Published: 132 days ago (SLA: 90 days)
  • CVSS Score: 5.3
  • CVE: CVE-2026-65913
  1. Permissive List of Allowed Inputs
  • ID: SNYK-JS-DOMPURIFY-15874905
  • Package: dompurify@3.3.0
  • Published: 132 days ago (SLA: 90 days)
  • CVSS Score: 5.3
  • CVE: CVE-2026-65912
  1. Operator Precedence Logic Error
  • ID: SNYK-JS-DOMPURIFY-16078387
  • Package: dompurify@3.3.0
  • Published: 119 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-41240
  1. Cross-site Scripting (XSS)
  • ID: SNYK-JS-DOMPURIFY-16132234
  • Package: dompurify@3.3.0
  • Published: 112 days ago (SLA: 90 days)
  • CVSS Score: 5.1
  • CVE: CVE-2026-41238
  1. Improper Validation of Specified Index, Position, or Offset in Input
  • ID: SNYK-JS-UUID-16133035
  • Package: uuid@8.3.2
  • Published: 112 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-41907
  1. Cross-site Scripting (XSS)
  • ID: SNYK-JS-POSTCSS-16189065
  • Package: postcss@8.4.31
  • Published: 111 days ago (SLA: 90 days)
  • CVSS Score: 5.3
  • CVE: CVE-2026-41305
  1. Acceptance of Extraneous Untrusted Data With Trusted Data
  • ID: SNYK-JS-NEXT-16638675
  • Package: next@16.1.5
  • Published: 93 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-44572
  1. Interpretation Conflict
  • ID: SNYK-JS-NEXT-16638676
  • Package: next@16.1.5
  • Published: 93 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-44576
  1. Use of Weak Hash
  • ID: SNYK-JS-NEXT-16638677
  • Package: next@16.1.5
  • Published: 93 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-44582

❌ BUILD FAILED - Security checks failed

Please review and fix the security vulnerabilities before merging.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants