dependabot/npm_and_yarn/apps/platform/next-16.2.11
safe490757a · fullPR #346reviewed 2026-07-24 20:10 UTC0H · 0M · 0L · 5I- Purpose
- Automated security patch for Next.js — dependabot detected 4 HIGH + 5 MODERATE CVEs in the pinned version
- Goal
- Upgrade apps/platform to Next.js 16.2.11 to patch all open CVEs against 16.0.10
- Sub-goals
- SG-1: Bump next from 16.0.10 to 16.2.11 in apps/platform/package.json
- What
- Single line in apps/platform/package.json: next version pin updated from 16.0.10 to 16.2.11
- Why
- Security patch — 4 HIGH (DoS via Server Actions, middleware bypass, SSRF x2) + 5 MODERATE CVEs fixed; existing pinned version is exposed
- Areas
- apps/platform/package.json+1−1
- Blast
- 1 file, +1/-1 line. All blast radius is in the framework runtime, not application code.
Findings · 5
security5
HIGH CVE resolved: DoS via Server Actions (GHSA-m99w-x7hq-7vfj)
apps/platform/package.json:63
App uses App Router with Server Actions — was exposed. Now patched in 16.2.11.
HIGH CVE resolved: Middleware/proxy bypass with Turbopack + single-locale i18n (GHSA-6gpp-xcg3-4w24)
apps/platform/package.json:63
App uses next-intl — elevated risk. Now patched in 16.2.11.
HIGH CVEs resolved: SSRF in rewrites + Server Actions custom servers (GHSA-p9j2-gv94-2wf4, GHSA-89xv-2m56-2m9x)
apps/platform/package.json:63
Both patched in 16.2.11.
5 MODERATE CVEs resolved: cache confusion x2, SVG DoS, Server Function disclosure, unbounded Edge payload
apps/platform/package.json:63
GHSA-68g3-v927-f742, GHSA-4633-3j49-mh5q, GHSA-q8wf-6r8g-63ch, GHSA-955p-x3mx-jcvp, GHSA-4c39-4ccg-62r3 — all patched.
No breaking API changes — 16.0.10 → 16.2.11 is a patch/security-only series
apps/platform/package.json:63
Release notes confirm only backported bug + security fixes; no feature changes or breaking API changes.