v16.2.11
Security
- Fixed Denial of Service in App Router using Server Actions
- Fixed Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- Fixed Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
- Fixed Server-Side Request Forgery in Server Actions on custom servers
- Fixed Cache confusion of response bodies for requests with bodies
- Fixed Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
- Fixed Denial of Service in the Image Optimization API using SVGs
- Fixed unauthenticated disclosure of internal Server Function endpoints
- Fixed unbounded Server Action payload in Edge runtime
This release contains security fixes for the following advisories:
High:
- Denial of Service in App Router using Server Actions
- Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
- Server-Side Request Forgery in Server Actions on custom servers
Moderate:
- Cache confusion of response bodies for requests with bodies
- Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
- Denial of Service in the Image Optimization API using SVGs
- Unauthenticated disclosure of internal Server Function endpoints
- Unbounded Server Action payload in Edge runtime