fix(deps): upgrade next to 15.5.24 — GHSA-2xp9-vwfh-vxw4 (Critical, unauth RCE in image optimizer) - #61
Open
ggcore0 wants to merge 1 commit into
Open
Conversation
Unauthenticated remote code execution in the Image Optimization API when AVIF files are optimized, via libheif in the sharp pipeline (Critical, CVSS v4 9.5). Affected: next >=10.0.0 <15.5.24 and next <16.3.3. Patched: 15.5.24 (15.x) and 16.3.3 (16.x). No backports exist below 15.5.24. GHSA-2xp9-vwfh-vxw4 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016uwkrHFFWaqRawqPYg6733
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrades
nextto 15.5.24 to remediate GHSA-2xp9-vwfh-vxw4 — Unauthenticated Remote Code Execution in the Image Optimization API when AVIF files are used (Critical, CVSS v4 9.5).A flaw in
libheif, reached through thesharpimage pipeline that Next.js uses for image optimization, allows arbitrary code execution when a crafted AVIF file is optimized. It needs no authentication and no user interaction. The patch disables AVIF optimization until the fix propagates through the dependency chain.next >= 10.0.0 < 15.5.24,next < 16.3.315.5.24(15.x line),16.3.3(16.x line)libheif)There are no backports below 15.5.24 — 14.x and older have no fixed release at all.
Why this repo
These are tutorial frontends that developers copy as a starting point, so the pinned versions propagate into downstream projects.
Changes
08-Guess-Game/Frontend/package.json:next15.0.2→15.5.2410-Advanced-Stake-Dapp/Frontend/package.json:next15.0.2→15.5.2411-Bridge-Token-Using-Chainlink/frontend/package.json:next15.2.4→15.5.2412-Core-MultiSig/Frontend/package.json:next15.0.2→15.5.2413-Core-Test-Token-Faucet/Frontend/package.json:next15.0.2→15.5.2414-Corelend/Frontend/package.json:next15.0.2→15.5.2415-dns-protocol/Frontend/package.json:next15.0.2→15.5.2416-Pump.Core/Frontend/package.json:next15.0.2→15.5.24Lockfiles regenerated with the repo's own package manager so this is ready to merge:
08-Guess-Game/Frontend/package-lock.json10-Advanced-Stake-Dapp/Frontend/package-lock.json11-Bridge-Token-Using-Chainlink/frontend/package-lock.json12-Core-MultiSig/Frontend/package-lock.json13-Core-Test-Token-Faucet/Frontend/package-lock.json14-Corelend/Frontend/package-lock.json15-dns-protocol/Frontend/package-lock.json16-Pump.Core/Frontend/package-lock.jsonThe lockfile churn beyond
nextitself is confined to that dependency's own graph —@next/env, the@next/swc-*platform binaries, andsharp/@img/sharp-libvips-*. Thelibvipsbump is worth noting: it carries the actual upstreamlibheiffix, not just the Next.js-side mitigation. No unrelated packages were upgraded.Warning
This PR covers the eight tutorial frontends that are on the 15.x line. Other Next.js projects elsewhere in this repo may still need review.
Verification
nextresolves to the patched version in every lockfile in this PR🤖 Generated with Claude Code
https://claude.ai/code/session_016uwkrHFFWaqRawqPYg6733