[Aikido] Fix security issue in next via minor version upgrade from 15.4.8 to 15.5.21

[aikido-autofix]

Upgrade Next.js to fix SSRF in WebSocket requests and multiple DoS vulnerabilities in App Router endpoints via malicious deserialization.

✅ Code not affected by breaking changes.

✅ No breaking changes from the Next.js 15.4.8 to 15.5.16 upgrade affect this codebase.

The codebase analysis shows:

• No next.config.js file exists, so no experimental flags (dynamicIO, strictNextHead, cacheComponents) are configured

• No usage of useMDXComponents found

• No usage of cookies() or headers() from next/headers found

• No AMP-related code (useAmp, withAmp, or amp: config) found

• No usage of unstable_rootParams found

• No middleware file exists

• The app/layout.tsx is a server component but doesn't use any deprecated APIs

• All other components in the app directory are client components (marked with 'use client')

The demo Next.js application uses only stable Next.js APIs like next/link, next/router, and next/navigation, which are unaffected by these breaking changes.

All breaking changes by upgrading next from version 15.4.8 to 15.5.21 (CHANGELOG)

Version	Description
15.5.0	refactor: rename experimental.dynamicIO to experimental.cacheComponents: #81562
15.5.0	Remove useMDXComponents argument: #80871
15.5.0	Remove experimental.strictNextHead: #81882
15.5.0	[Cache Components] Disallow sync access of cookies & headers at runtime: #82564
15.5.0	Turbopack: set window.next.turbopack instead: #82580
15.5.0	[Deprecation Warnings]: add amp deprecation warning: #82551
15.5.0	[Deprecation Warnings]: add unstable_rootParams deprecation warning: #82582
15.5.0	Stabilize node middleware support: #81907

✅ 6 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-44578	HIGH	[next] Self-hosted applications are vulnerable to server-side request forgery (SSRF) through crafted WebSocket upgrade requests, allowing attackers to proxy requests to arbitrary destinations and potentially expose internal services or cloud metadata. Vercel-hosted deployments are unaffected.
GHSA-mwv6-3258-q52c	HIGH	[next] A malicious HTTP request to App Router endpoints can cause server process hangs and excessive CPU consumption during deserialization, resulting in denial of service attacks.
GHSA-q4gf-8mx6-v5v3	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
GHSA-8h8q-6873-q5fj	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
CVE-2026-44575	MEDIUM	[next] Authorization bypass in App Router allows unauthorized access to protected content through transport-specific route variants (.rsc and segment-prefetch URLs) that bypass middleware checks. Attackers can reach protected pages without proper authorization verification.
GHSA-w37m-7fhw-fmv9	MEDIUM	[next] A malicious HTTP request can expose compiled source code of Server Functions in affected React packages and frameworks, potentially revealing business logic through information disclosure.

🤖 Remediation details

Upgrade next to resolve multiple security vulnerabilities

Short summary

This PR fixes several high- and medium-severity vulnerabilities in the next package by upgrading it from 15.4.8 to 15.5.21 in both the root package.json (devDependencies) and the packages/demo-nextjs workspace member package.json. The yarn.lock lockfile was refreshed accordingly, leaving a single resolved instance of next at 15.5.21.

next

next was declared as an exact-pinned direct dependency in two places: the monorepo root package.json and the packages/demo-nextjs workspace manifest. Both pins were updated from 15.4.8 to 15.5.21 — the smallest 15.x release that satisfies all patched-version floors across the full set of advisories in scope (the highest floor being 15.5.21 for CVE-2026-64644, which was itself introduced by an intermediate upgrade to 15.5.16). Because next is a direct dependency in both manifests, no parent-chain or resolution override was needed; a standard yarn install --ignore-engines --ignore-scripts from the lockfile root was sufficient to produce a clean, single-entry lockfile block at the target version.

Version changes

Package	From	To	Why updated
next	15.4.8	15.5.21	Direct CVE fix (root package.json devDependency)
next	15.4.8	15.5.21	Direct CVE fix (packages/demo-nextjs workspace dependency)
@next/env	15.4.8	15.5.21	Transitive lockfile refresh after next bump
@next/swc-linux-x64-gnu	15.4.8	15.5.21	Transitive lockfile refresh after next bump
@next/swc-linux-x64-musl	15.4.8	15.5.21	Transitive lockfile refresh after next bump

[gitstream-cm]

🚨 gitStream Monthly Automation Limit Reached 🚨

Your organization has exceeded the number of pull requests allowed for automation with gitStream.
Monthly PRs automated: 250/250

To continue automating your PR workflows and unlock additional features, please contact LinearB.

[pr-auditor]

✅ Security Analysis Results

Great news! No security issues found in this pull request.

Analysis Summary:

• 📁 Files reviewed: 3
• ✅ No security vulnerabilities detected

---

💡 Trigger a new security scan by commenting @pr-auditor rescan on this PR.

Security analysis powered by Claude Sonnet 4.6 via pr-auditor | Questions? Contact #dx-team or check out this page