[aikido-autofix]

Upgrade Next.js and Sharp to fix critical RCE vulnerabilities in image optimization (AVIF/libheif), memory corruption, and high-severity SSRF, DoS, and connection exhaustion issues.

✅ Code not affected by breaking changes.

✅ No breaking changes from either package upgrade affect this codebase.

Next.js (15.4.8 => 15.5.28):

• No next.config.js file exists in the demo-nextjs package, so configuration-related changes (experimental.dynamicIO, experimental.strictNextHead) don't apply

• No usage of useMDXComponents, unstable_rootParams, or AMP features found

• No synchronous usage of cookies() or headers() in server components (all components using Next.js APIs are client components marked with 'use client')

• No usage of window.next.version or window.next.turbopack

• No middleware files that would be affected by the node middleware stabilization

Sharp (0.34.5 => 0.35.5):

• Sharp is only present as a transitive dependency of Next.js (in yarn.lock)

• No direct imports or usage of sharp found in any source files

• The Node.js version requirement change (>=18 to >=20.9.0) is not an issue since the codebase already requires Node.js >=18, and the upgrade to sharp 0.35.x is handled internally by Next.js

All components in the Next.js demo are either client components or use standard Next.js patterns that remain compatible with version 15.5.28.

All breaking changes by upgrading next from version 15.4.8 to 15.5.28 (CHANGELOG)

Version	Description
15.5.0	refactor: rename experimental.dynamicIO to experimental.cacheComponents: #81562
15.5.0	Remove useMDXComponents argument: #80871
15.5.0	Remove experimental.strictNextHead: #81882
15.5.0	[Cache Components] Disallow sync access of cookies & headers at runtime: #82564
15.5.0	Turbopack: set window.next.turbopack instead: #82580
15.5.0	[Deprecation Warnings]: add amp deprecation warning: #82551
15.5.0	[Deprecation Warnings]: add unstable_rootParams deprecation warning: #82582
15.5.0	Stabilize node middleware support: #81907

All breaking changes by upgrading sharp from version 0.34.5 to 0.35.5 (CHANGELOG)

Version	Description
0.35.0	Drop support for Node.js 18, now requires Node.js >= 20.9.0.
0.35.0	Remove install script from package.json file. Compiling from source is now opt-in via the build script.
0.35.0	Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.
0.35.0	Add limitInputChannels with a default value of 5.
0.35.0	Remove deprecated failOnError constructor property.
0.35.0	Remove deprecated paletteBitDepth from metadata response.
0.35.0	Remove deprecated properties from sharpen operation.
0.35.0	Rename format.jp2k as format.jp2 for API consistency.

✅ 12 CVEs resolved by this upgrade, including 2 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-2xp9-vwfh-vxw4	🚨 CRITICAL	[next] A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled.
GHSA-2464-fhr4-w9xw	🚨 CRITICAL	[next] A memory-related vulnerability in the Image Optimization library can lead to remote code execution (RCE) on glibc-based Linux systems when processing images.
CVE-2026-44578	HIGH	[next] A server-side request forgery vulnerability in self-hosted Next.js applications allows attackers to craft WebSocket upgrade requests that proxy arbitrary requests to internal or external destinations, potentially exposing internal services or cloud metadata. Vercel-hosted deployments are unaffected.
CVE-2026-94482	HIGH	[next] Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. ...
CVE-2026-44579	HIGH	[next] Applications using Partial Prerendering with Cache Components are vulnerable to connection exhaustion via crafted POST requests to server actions, causing request-body handling deadlocks that consume server resources and lead to denial of service. Malicious actors can exhaust file descriptors and server capacity, preventing legitimate users from accessing the application.
GHSA-h25m-26qc-wcjf	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage, out-of-memory exceptions, or server crashes, resulting in denial of service.
GHSA-mwv6-3258-q52c	HIGH	[next] A malicious HTTP request to App Router endpoints can cause server deserialization to hang and consume CPU, resulting in denial of service (DoS).
GHSA-q4gf-8mx6-v5v3	HIGH	[next] A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23869](https://github.com/facebook/react/security/...
GHSA-8h8q-6873-q5fj	HIGH	[next] A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react/security/...
CVE-2026-29057	MEDIUM	[next] HTTP request smuggling vulnerability in Next.js rewrites with chunked DELETE/OPTIONS requests allows attackers to bypass route restrictions and access unintended backend endpoints. An attacker could smuggle malicious requests to internal or admin routes through request boundary disagreement between proxy and backend.
GHSA-w37m-7fhw-fmv9	MEDIUM	[next] A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55183](https://www.cve.org/...
GHSA-wq5f-xc86-pv6w	HIGH	[sharp] A memory vulnerability in the upstream librsvg dependency can lead to remote code execution on glibc-based Linux systems under certain runtime conditions. The vulnerability affects SVG image decoding and requires specific runtime conditions to exploit.

🤖 Remediation details

Fix critical and high-severity vulnerabilities in next and sharp

Short summary

This PR remediates multiple critical, high, and medium-severity vulnerabilities in two packages: next (the direct dependency) and sharp (a transitive optional dependency pulled in by next). The fix updates the exact-pinned next version in both the root package.json and the packages/demo-nextjs workspace member manifest, which in turn causes yarn.lock to resolve sharp to a patched version as well.

next

next was pinned exactly at 15.4.8 in two places: the root package.json (as a devDependency) and packages/demo-nextjs/package.json (as a dependency). Both declarations were bumped to 15.5.28, the minimum version that satisfies every advisory's patched-version floor across all listed CVEs. Because both manifests used the same exact pin, both were updated together as a related package alignment in a single edit batch, followed by a yarn install --ignore-engines --ignore-scripts to refresh yarn.lock and remove the stale next@15.4.8 lockfile entry.

sharp

sharp is not declared directly in any manifest; it is an optional transitive dependency of next. Under next@15.4.8, the lockfile resolved sharp to 0.34.5 via the selector sharp@^0.34.3. After bumping next to 15.5.28, that release widens its optional dependency declaration to ^0.34.3 || ^0.35.5, which allows Yarn to resolve sharp to 0.35.5—the patched minimum. No resolutions override was required; the lockfile refresh after the next bump was sufficient to pull in the fixed sharp version and remove the stale sharp@^0.34.3@0.34.5 entry.

Version changes

Package	From	To	Why updated
next	15.4.8	15.5.28	Direct CVE fix (root package.json devDependency)
next	15.4.8	15.5.28	Direct CVE fix (workspace member packages/demo-nextjs)
sharp	0.34.5	0.35.5	Transitive CVE fix after parent bump (next)
@next/env	15.4.8	15.5.28	Lockfile refresh — sibling of next
@next/swc-linux-x64-gnu	15.4.8	15.5.28	Lockfile refresh — sibling of next
@next/swc-linux-x64-musl	15.4.8	15.5.28	Lockfile refresh — sibling of next
@img/sharp-linux-x64	0.34.5	0.35.5	Lockfile refresh — optional platform binary for sharp
@img/sharp-linuxmusl-x64	0.34.5	0.35.5	Lockfile refresh — optional platform binary for sharp
@img/colour	1.0.x	1.1.0	Lockfile refresh — dependency of sharp@0.35.5

[jenkins-tf]

[BOT] Preview available with hash cd91264313f3ba3f2c18ea22e085374ddd9124df here.