chore(deps): update dependency next to v16.2.3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
next (source)	16.1.6 → 16.2.3

GitHub Vulnerability Alerts

CVE-2026-27977

Summary

In next dev, cross-site protections for internal development endpoints could treat Origin: null as a bypass case even when allowedDevOrigins is configured. This could allow privacy-sensitive or opaque browser contexts, such as sandboxed documents, to access privileged internal dev-server functionality unexpectedly.

Impact

If a developer visits attacker-controlled content while running an affected next dev server with allowedDevOrigins configured, attacker-controlled browser code may be able to connect to internal development endpoints and interact with sensitive dev-server functionality that should have remained blocked.

This issue affects development mode only. It does not affect next start, and it does not expose internal debugging functionality to the network by default.

Patches

Fixed by validating Origin: null through the same cross-site origin-allowance checks used for other origins on internal development endpoints.

Workarounds

If upgrade is not immediately possible:

• Do not expose next dev to untrusted networks.
• If you use allowedDevOrigins, reject requests and websocket upgrades with Origin: null for internal dev endpoints at your proxy.

CVE-2026-27978

Summary

origin: null was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests.

Impact

An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF).

Patches

Fixed by treating 'null' as an explicit origin value and enforcing host/origin checks unless 'null' is explicitly allowlisted in experimental.serverActions.allowedOrigins.

Workarounds

If upgrade is not immediately possible:

• Add CSRF tokens for sensitive Server Actions.
• Prefer SameSite=Strict on sensitive auth cookies.
• Do not allow 'null' in serverActions.allowedOrigins unless intentionally required and additionally protected.

CVE-2026-27979

Summary

A request containing the next-resume: 1 header (corresponding with a PPR resume request) would buffer request bodies without consistently enforcing maxPostponedStateSize in certain setups. The previous mitigation protected minimal-mode deployments, but equivalent non-minimal deployments remained vulnerable to the same unbounded postponed resume-body buffering behavior.

Impact

In applications using the App Router with Partial Prerendering capability enabled (via experimental.ppr or cacheComponents), an attacker could send oversized next-resume POST payloads that were buffered without consistent size enforcement in non-minimal deployments, causing excessive memory usage and potential denial of service.

Patches

Fixed by enforcing size limits across all postponed-body buffering paths and erroring when limits are exceeded.

Workarounds

If upgrade is not immediately possible:

• Block requests containing the next-resume header, as this is never valid to be sent from an untrusted client.

CVE-2026-29057

Summary

When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

Impact

An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.

Patches

The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so content-length: 0 is added only when both content-length and transfer-encoding are absent, and transfer-encoding is no longer removed in that code path.

Workarounds

If upgrade is not immediately possible:

• Block chunked DELETE/OPTIONS requests on rewritten routes at your edge/proxy.
• Enforce authentication/authorization on backend routes per our security guidance.

CVE-2026-27980

Summary

The default Next.js image optimization disk cache (/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.

Impact

An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.

Patches

Fixed by adding an LRU-backed disk cache with images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. Setting maximumDiskCacheSize: 0 disables disk caching.

Workarounds

If upgrade is not immediately possible:

• Periodically clean .next/cache/images.
• Reduce variant cardinality (e.g., tighten values for images.localPatterns, images.remotePatterns, and images.qualities)

GHSA-q4gf-8mx6-v5v3

A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this changelog.

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.

---

Release Notes

vercel/next.js (next)

v16.2.3

Compare Source

v16.2.2

Compare Source

v16.2.1

Compare Source

v16.2.0

Compare Source

v16.1.7

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 14 workspace projects
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 22, reused 0, downloaded 0, added 0
Progress: resolved 24, reused 0, downloaded 0, added 0
e2e                                      |  WARN  deprecated @koa/router@14.0.0
Progress: resolved 34, reused 0, downloaded 0, added 0
Progress: resolved 56, reused 0, downloaded 0, added 0
Progress: resolved 80, reused 0, downloaded 0, added 0
Progress: resolved 81, reused 0, downloaded 0, added 0
Progress: resolved 85, reused 0, downloaded 0, added 0
Progress: resolved 99, reused 0, downloaded 0, added 0
Progress: resolved 115, reused 0, downloaded 0, added 0
/tmp/renovate/repos/github/mnahkies/openapi-code-generator/packages/documentation:
 ERR_PNPM_NO_MATURE_MATCHING_VERSION  Version 16.2.3 (released 2 days ago) of @next/swc-darwin-x64 does not meet the minimumReleaseAge constraint

This error happened while installing the dependencies of next@16.2.3

The latest release of @next/swc-darwin-x64 is "16.2.3". Published at 4/8/2026

Other releases are:
  * next-11: 11.1.4 published at 1/27/2022
  * next-12-2-6: 12.2.6 published at 9/29/2022
  * next-12-3-2: 12.3.4 published at 11/21/2022
  * next-14-1: 14.1.1 published at 2/29/2024
  * next-13: 13.5.10 published at 3/24/2025
  * next-14: 14.2.33 published at 9/23/2025
  * next-15-4: 15.4.8 published at 12/3/2025
  * next-15-0: 15.1.9 published at 12/3/2025
  * next-15-0-0: 15.0.5 published at 12/3/2025
  * next-15-5: 15.5.15 published at 4/8/2026
  * canary: 16.2.1-canary.32 published at 4/10/2026 11:32:00 PM

If you need the full list of all 2506 published versions run "pnpm view @next/swc-darwin-x64 versions".

If you want to install the matched version ignoring the time it was published, you can add the package name to the minimumReleaseAgeExclude setting. Read more about it: https://pnpm.io/settings#minimumreleaseageexclude