Security: 18 npm advisories, incl. 10 reaching production via next and react-server-dom-webpack

[PouyanJay]

npm audit reports 18 vulnerabilities — 13 high, 4 moderate, 1 low, 0 critical.

Reaches production

Both fixes are non-major.

Package	Current	Fix
next	16.2.6	16.3.0
react-server-dom-webpack	19.2.6	19.2.8

next accounts for 9 advisories on its own:

• SSRF in rewrites via attacker-controlled destination hostname
• SSRF in Server Actions on custom servers
• Cache confusion of response bodies for requests with bodies (and a variant for invalid UTF-8)
• Unauthenticated disclosure of internal Server Function endpoints
• Denial of Service in the Image Optimization API using SVGs
• Denial of Service in App Router using Server Actions
• Unbounded Server Action payload in Edge runtime
• Middleware/Proxy bypass in App Router with Turbopack and a single locale

react-server-dom-webpack adds a DoS in Server Functions.

Note the Image Optimization advisory is relevant because worker/index.ts serves /_vinext/image — though dangerouslyAllowSVG is commented out and .svg sources auto-skip, so that particular vector is already closed by configuration.

Build and dev only

vite, wrangler, miniflare, undici (12 advisories), ws, sharp, esbuild, postcss, js-yaml, brace-expansion, fast-uri. None ship to the browser, and since vercel.json overrides the build to plain next build, the Cloudflare chain is largely dev-time now.

npm audit fix --force wants vite@8.2.1 and @cloudflare/vite-plugin@1.51.0, both outside the exact pins in package.json — that is the breaking path and is deliberately not proposed here.

Scope

This issue covers the two production-facing bumps only. Kept deliberately narrow so it can be reverted on its own if a bump regresses the build.

Depends on #11 — the test suite needs to work before a dependency bump can be verified.