fix(deps): update dependency next to v16.3.3 [security] by renovate[bot] · Pull Request #608 · LedgerHQ/wallet-api

renovate · 2026-09-11T03:54:10Z

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	`16.2.7` → `16.3.3`

Next.js: Denial of Service in App Router using Server Actions

CVE-2026-64641 / GHSA-m99w-x7hq-7vfj

More information

Details

Impact

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.

Workarounds

No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

Severity

CVSS Score: 8.2 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

CVE-2026-64642 / GHSA-6gpp-xcg3-4w24

More information

Details

Impact

Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication.

Workarounds

If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.

Severity

CVSS Score: 8.3 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

CVE-2026-64645 / GHSA-p9j2-gv94-2wf4

More information

Details

Impact

A rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect.

This affects any destination that puts a dynamic segment in the hostname, whether from the path:

// next.config.js
module.exports = {
  async rewrites() {
    return [
      {
        source: '/:tenant',
        destination: 'https://:tenant.api.example.com',
      },
    ]
  },
}

or from a has capture:

// next.config.js
module.exports = {
  async rewrites() {
    return [
      {
        source: '/',
        has: [{ type: 'query', key: 'region', value: '(?<region>.+)' }],
        destination: 'https://:region.api.example.com',
      },
    ]
  },
}

Workarounds

If you cannot upgrade immediately, do not build the hostname of an external rewrites() or redirects() destination from user-controlled input. If a dynamic subdomain is required, constrain the value to hostname-safe characters: value: '(?<region>[a-z0-9-]+)'.

Severity

CVSS Score: 8.3 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js: Server-Side Request Forgery in Server Actions on custom servers

CVE-2026-64649 / GHSA-89xv-2m56-2m9x

More information

Details

Impact

When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization.

Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward.

Workarounds

If you cannot upgrade, ensure clients do not control the host header your application receives. Pin or validate Host and X-Forwarded-Host at your edge or proxy. On version 14.2.0 and later, you can additionally set the __NEXT_PRIVATE_ORIGIN environment variable to your deployment's real origin:

__NEXT_PRIVATE_ORIGIN=https://www.example.com node server.js

#### Severity
- CVSS Score: 8.3 / 10 (High)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`

#### References
- [https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x)
- [https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b](https://redirect.github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b)
- [https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498](https://redirect.github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498)
- [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)
- [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)
- [https://github.com/advisories/GHSA-89xv-2m56-2m9x](https://redirect.github.com/advisories/GHSA-89xv-2m56-2m9x)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-89xv-2m56-2m9x) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
[CVE-2026-75604](https://nvd.nist.gov/vuln/detail/CVE-2026-75604) / [GHSA-p293-qw3h-jr36](https://redirect.github.com/advisories/GHSA-p293-qw3h-jr36)

<details>
<summary>More information</summary>

#### Details
##### Impact

A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.

##### Workaround

There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.

#### Severity
- CVSS Score: 9.0 / 10 (Critical)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H`

#### References
- [https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36)
- [https://nvd.nist.gov/vuln/detail/CVE-2026-75604](https://nvd.nist.gov/vuln/detail/CVE-2026-75604)
- [https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b](https://redirect.github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b)
- [https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3](https://redirect.github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3)
- [https://github.com/vercel/next.js/releases/tag/v15.5.24](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.24)
- [https://github.com/vercel/next.js/releases/tag/v16.3.3](https://redirect.github.com/vercel/next.js/releases/tag/v16.3.3)
- [https://github.com/advisories/GHSA-p293-qw3h-jr36](https://redirect.github.com/advisories/GHSA-p293-qw3h-jr36)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-p293-qw3h-jr36) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
[GHSA-2xp9-vwfh-vxw4](https://redirect.github.com/advisories/GHSA-2xp9-vwfh-vxw4)

<details>
<summary>More information</summary>

#### Details
A vulnerability in the underlying `libheif` library used by `sharp` which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.

Until a fix has propagated, optimization of AVIF files is disabled.

#### Severity
- CVSS Score: 9.5 / 10 (Critical)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

#### References
- [https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497](https://redirect.github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497)
- [https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4)
- [https://github.com/vercel/next.js/pull/97875](https://redirect.github.com/vercel/next.js/pull/97875)
- [https://github.com/vercel/next.js/pull/97931](https://redirect.github.com/vercel/next.js/pull/97931)
- [https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3](https://redirect.github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3)
- [https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2](https://redirect.github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2)
- [https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998](https://redirect.github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998)
- [https://github.com/vercel/next.js/releases/tag/v15.5.24](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.24)
- [https://github.com/vercel/next.js/releases/tag/v16.3.3](https://redirect.github.com/vercel/next.js/releases/tag/v16.3.3)
- [https://github.com/advisories/GHSA-2xp9-vwfh-vxw4](https://redirect.github.com/advisories/GHSA-2xp9-vwfh-vxw4)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-2xp9-vwfh-vxw4) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>vercel/next.js (next)</summary>

### [`v16.3.3`](https://redirect.github.com/vercel/next.js/compare/v16.3.2...v16.3.3)

[Compare Source](https://redirect.github.com/vercel/next.js/compare/v16.3.2...v16.3.3)

### [`v16.3.2`](https://redirect.github.com/vercel/next.js/releases/tag/v16.3.2)

[Compare Source](https://redirect.github.com/vercel/next.js/compare/v16.3.1...v16.3.2)

> \[!NOTE]
> This release is backporting bug fixes. It does **not** include all pending features/changes on canary.

##### Core Changes

- \[backport] Scope app-entry export validation to files inside the app directory ([#&#8203;97357](https://redirect.github.com/vercel/next.js/issues/97357))
- \[backport] Fix catch-all index page being served for every other slug ([#&#8203;97416](https://redirect.github.com/vercel/next.js/issues/97416))
- \[16.3] Turbopack: don't trace embedded WASM loader helpers ([#&#8203;97353](https://redirect.github.com/vercel/next.js/issues/97353)) ([#&#8203;97463](https://redirect.github.com/vercel/next.js/issues/97463))
- \[16.3] Turbopack: retain conditions when replacing resolve request keys ([#&#8203;97453](https://redirect.github.com/vercel/next.js/issues/97453))
- \[16.3.x] Fix Turbopack worker chunk loading with asset prefix ([#&#8203;97419](https://redirect.github.com/vercel/next.js/issues/97419))
- \[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT ([#&#8203;97603](https://redirect.github.com/vercel/next.js/issues/97603))

##### Credits

Huge thanks to [@&#8203;lubieowoce](https://redirect.github.com/lubieowoce), [@&#8203;unstubbable](https://redirect.github.com/unstubbable), [@&#8203;timneutkens](https://redirect.github.com/timneutkens), [@&#8203;mischnic](https://redirect.github.com/mischnic), and [@&#8203;eps1lon](https://redirect.github.com/eps1lon) for helping!

### [`v16.3.1`](https://redirect.github.com/vercel/next.js/compare/v16.3.0...v16.3.1)

[Compare Source](https://redirect.github.com/vercel/next.js/compare/v16.3.0...v16.3.1)

### [`v16.3.0`](https://redirect.github.com/vercel/next.js/compare/v16.2.12...v16.3.0)

[Compare Source](https://redirect.github.com/vercel/next.js/compare/v16.2.12...v16.3.0)

### [`v16.2.12`](https://redirect.github.com/vercel/next.js/compare/v16.2.11...v16.2.12)

[Compare Source](https://redirect.github.com/vercel/next.js/compare/v16.2.11...v16.2.12)

### [`v16.2.11`](https://redirect.github.com/vercel/next.js/compare/v16.2.10...v16.2.11)

[Compare Source](https://redirect.github.com/vercel/next.js/compare/v16.2.10...v16.2.11)

### [`v16.2.10`](https://redirect.github.com/vercel/next.js/compare/v16.2.9...v16.2.10)

[Compare Source](https://redirect.github.com/vercel/next.js/compare/v16.2.9...v16.2.10)

### [`v16.2.9`](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.9)

[Compare Source](https://redirect.github.com/vercel/next.js/compare/v16.2.8...v16.2.9)

Empty release to ensure `next@latest` points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

### [`v16.2.8`](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.8)

[Compare Source](https://redirect.github.com/vercel/next.js/compare/v16.2.7...v16.2.8)

Release with no changes in an attempt to fix `next@latest` pointing at a prerelease version.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/LedgerHQ/wallet-api).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

changeset-bot · 2026-09-11T03:54:15Z

⚠️ No Changeset found

Latest commit: 4381ac8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2026-09-11T03:54:16Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
wallet-api-wallet-api-tools	Ready	Preview	Sep 29, 2026 2:47pm UTC

renovate Bot requested review from a team, ComradeAERGO and Justkant as code owners September 11, 2026 03:54

vercel Bot deployed to Preview September 11, 2026 03:54 View deployment

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 292e60f to d8c49dc Compare September 15, 2026 19:03

vercel Bot deployed to Preview September 15, 2026 19:03 View deployment

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from d8c49dc to c565626 Compare September 24, 2026 23:29

vercel Bot deployed to Preview September 24, 2026 23:30 View deployment

fix(deps): update dependency next to v16.3.3 [security]

4381ac8

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from c565626 to 4381ac8 Compare September 29, 2026 14:46

vercel Bot deployed to Preview September 29, 2026 14:47 View deployment

Navigation Menu

fix(deps): update dependency next to v16.3.3 [security] - #608

fix(deps): update dependency next to v16.3.3 [security]#608
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-next-vulnerability

renovate Bot commented Sep 11, 2026

Uh oh!

changeset-bot Bot commented Sep 11, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Sep 11, 2026 •

edited

Loading

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Sep 11, 2026

Next.js: Denial of Service in App Router using Server Actions

Details

Impact

Workarounds

Severity

References

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Details

Impact

Workarounds

Severity

References

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Details

Impact

Workarounds

Severity

References

Next.js: Server-Side Request Forgery in Server Actions on custom servers

Details

Impact

Workarounds

Uh oh!

changeset-bot Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

vercel Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

changeset-bot Bot commented Sep 11, 2026 •

edited

Loading

vercel Bot commented Sep 11, 2026 •

edited

Loading