Next.js v15.5.21 Security Update: SSRF, Middleware Bypass & DoS Vulnerabilities

Vulnerability Overview Version: v15.5.21 Release Date: Last week Author: eps1lon Impact Scope High-Severity Vulnerabilities 1. Denial of Service in App Router - Description: Denial of Service vulnerability in the App Router involving Server Actions - Link: Denial of Service in App Router using Server Actions 2. Middleware / Proxy bypass Vulnerability - Description: Middleware / Proxy bypass vulnerability in App Router applications using Turbopack and single locale - Link: Middleware / Proxy bypass in App Router applications using Turbopack and single locale 3. Server-Side Request Forgery (SSRF) Vulnerability - Description: SSRF vulnerability in rewrites via attacker-controlled destination hostname - Link: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname 4. Server-Side Request Forgery (SSRF) Vulnerability in Server Actions - Description: SSRF vulnerability in Server Actions on custom servers - Link: Server-Side Request Forgery in Server Actions on custom servers Medium-Severity Vulnerabilities 1. Response Body Confusion Vulnerability - Description: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences - Link: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences 2. Denial of Service Vulnerability in Image Optimization API - Description: Denial of Service vulnerability in the Image Optimization API using SVGs - Link: Denial of Service in the Image Optimization API using SVGs 3. Unauthorized Disclosure of Internal Server Function Endpoints - Description: Unauthorized disclosure of internal Server Function endpoints - Link: Unauthenticated disclosure of internal Server Function endpoints 4. Unbounded Server Action Payload in Edge Runtime - Description: Unbounded Server Action payload in Edge runtime - Link: Unbounded Server Action payload in Edge runtime Remediation Updated Version: Upgrade to v15.5.21 Download Links: - Source code (zip) - Source code (tar.gz) Notes This release includes fixes for the aforementioned security vulnerabilities. It is recommended to update to the latest version as soon as possible to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

Next.js v15.5.21 Security Update: SSRF, Middleware Bypass & DoS Vulnerabilities

More from this source