Sourced from next's releases.
v15.5.16
This release contains security fixes for the following advisories:
High:
- GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
- GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
- GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
- GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
- GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
- GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n
Moderate:
- GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
- GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
- GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
- GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses
Low:
ad6fd4e
v15.5.1679d7dff
Ignore malformed CSP nonce headers (#103)c4f6908
router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)6c72e0b
Fix i18n middleware matching for default-locale data routes (#82) (#100)3e24711
fix: add explicit checks for RSC header (#83) (#99)2592651
fix proxy matching for segment prefetch URLs (#89) (#97)73de045
Strip next-resume header from incoming requests (#93)086dfa7
Escape properties for beforeInteractive scripts (15.5) (#87)8708076
fix: skip internal param normalization in unsupported environmentsebc1a54
[15.x] Type hardening and performance improvements (#81)This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.