[Aikido] Fix security issue in next via minor version upgrade from 15.4.8 to 15.5.21

[aikido-autofix]

Upgrade Next.js to fix SSRF via WebSocket requests, DoS attacks on Server Functions, authorization bypass in middleware, and source code disclosure vulnerabilities.

✅ Code not affected by breaking changes.

✅ No breaking changes from the Next.js 15.4.8 to 15.5.16 upgrade affect this codebase.

The codebase contains a Next.js demo application (packages/demo-nextjs) that uses both Pages Router and App Router, but none of the breaking changes apply:

• No usage of experimental.dynamicIO or experimental.strictNextHead configuration options

• No usage of useMDXComponents with arguments

• No synchronous access to cookies() or headers() in server components (the app only uses client components with 'use client' directive)

• No usage of window.next.turbopack or related properties

• No usage of AMP features

• No usage of unstable_rootParams

• No custom middleware that would be affected by the node middleware stabilization

All components in the demo app are either client components or simple server components without dynamic API usage, making them unaffected by the breaking changes in this upgrade.

All breaking changes by upgrading next from version 15.4.8 to 15.5.21 (CHANGELOG)

Version	Description
15.5.0	refactor: rename experimental.dynamicIO to experimental.cacheComponents: #81562
15.5.0	Remove useMDXComponents argument: #80871
15.5.0	Remove experimental.strictNextHead: #81882
15.5.0	[Cache Components] Disallow sync access of cookies & headers at runtime: #82564
15.5.0	Turbopack: set window.next.turbopack instead: #82580
15.5.0	[Deprecation Warnings]: add amp deprecation warning: #82551
15.5.0	[Deprecation Warnings]: add unstable_rootParams deprecation warning: #82582
15.5.0	Stabilize node middleware support: #81907

✅ 5 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-44578	HIGH	[next] Self-hosted applications are vulnerable to server-side request forgery (SSRF) through crafted WebSocket upgrade requests, allowing attackers to proxy requests to arbitrary destinations and potentially expose internal services or cloud metadata. Vercel-hosted deployments are unaffected.
GHSA-q4gf-8mx6-v5v3	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
GHSA-8h8q-6873-q5fj	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
CVE-2026-44575	MEDIUM	[next] Authorization bypass in App Router allows unauthorized access to protected content through transport-specific route variants (.rsc and segment-prefetch URLs) that bypass middleware checks. Attackers can reach protected pages without proper authorization verification.
GHSA-w37m-7fhw-fmv9	MEDIUM	[next] A malicious HTTP request can expose compiled source code of Server Functions in affected React packages and frameworks, potentially revealing business logic through information disclosure.

🤖 Remediation details

Fix Next.js security vulnerabilities by upgrading next to 15.5.21

Short summary

This PR remediates multiple high- and medium-severity vulnerabilities in the next package by upgrading it from 15.4.8 to 15.5.21. The change is applied to two manifest files — the root package.json (devDependencies) and the workspace member packages/demo-nextjs/package.json (dependencies) — with the resolved version in yarn.lock updated accordingly.

next

next was pinned at 15.4.8 in both the root package.json and the packages/demo-nextjs/package.json workspace manifest, making it a direct dependency in both locations. The version was bumped to 15.5.21 — the smallest 15.x release that satisfies the patched-version floor for all advisories in scope, including CVE-2026-64644 which requires ≥ 15.5.21, and the earlier group (CVE-2026-44578, GHSA-q4gf-8mx6-v5v3, GHSA-8h8q-6873-q5fj, CVE-2026-44575, GHSA-w37m-7fhw-fmv9) which were fixed from 15.5.8–15.5.16 onward. Both manifest entries were updated and yarn install --ignore-engines --ignore-scripts was run from the repo root to refresh the single lockfile entry from next@15.5.16 to next@15.5.21.

Version changes

Package	From	To	Why updated
next	15.4.8 → (interim 15.5.16) → 15.5.21	15.5.21	Direct CVE fix (root devDependencies + workspace dependencies)

[gitstream-cm]

🚨 gitStream Monthly Automation Limit Reached 🚨

Your organization has exceeded the number of pull requests allowed for automation with gitStream.
Monthly PRs automated: 250/250

To continue automating your PR workflows and unlock additional features, please contact LinearB.

[pr-auditor]

✅ Security Analysis Results

Great news! No security issues found in this pull request.

Analysis Summary:

• 📁 Files reviewed: 3
• ✅ No security vulnerabilities detected

---

💡 Trigger a new security scan by commenting @pr-auditor rescan on this PR.

Security analysis powered by Claude Sonnet 4.6 via pr-auditor | Questions? Contact #dx-team or check out this page