v15.5.21
Security
- Fix Denial of Service in App Router using Server Actions
- Fix Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- Fix Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
- Fix Server-Side Request Forgery in Server Actions on custom servers
- Fix cache confusion of response bodies for requests with bodies
- Fix cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
- Fix Denial of Service in the Image Optimization API using SVGs
- Fix unauthenticated disclosure of internal Server Function endpoints
- Fix unbounded Server Action payload in Edge runtime
This release contains security fixes for the following advisories:
High:
- Denial of Service in App Router using Server Actions
- Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
- Server-Side Request Forgery in Server Actions on custom servers
Moderate:
- Cache confusion of response bodies for requests with bodies
- Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
- Denial of Service in the Image Optimization API using SVGs
- Unauthenticated disclosure of internal Server Function endpoints
- Unbounded Server Action payload in Edge runtime