Sourced from next's releases.
v15.5.21
This release contains security fixes for the following advisories:
High:
- Denial of Service in App Router using Server Actions
- Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
- Server-Side Request Forgery in Server Actions on custom servers
Moderate:
- Cache confusion of response bodies for requests with bodies
- Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
- Denial of Service in the Image Optimization API using SVGs
- Unauthenticated disclosure of internal Server Function endpoints
- Unbounded Server Action payload in Edge runtime
v15.5.20
Contains no changes except publishing
@next/swc-wasm-webwhich was accidentally not published since 15.5.15.15.5.19
[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
- [15.5.x] Don't drop
FormDataentries (#94244)Other
- [15.5.x] Fix CI (#94281)
Credits
Huge thanks to
@eps1lonfor helping!
e26f6ff
v15.5.217f5deeb
[15.x] Improve performance of checking valid MPA form submissions57c31f7
[15.x] Enforce serverActions.bodySizeLimit for Server
Actions in Edge runtimee3e5666
[15.x] Set correct origin for internal redirects in custom server35f5013
[15.x] Ensure exotic rewrite param values are properly encoded062f667
[15.x] fix(fetch-cache): key fetch(Request, init) by the effective
request577c9dc
[15.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies530d4fa
[15.x] fix(next/image): improve performance of detectContentType()8fabaf3
[15.x] Performance improvements when decoding React Server function
payloadsff12a61
[15.x] Validate server reference IDs during manifest lookup