Next.js has released security patches for v15.5.21 and v16.2.11 addressing nine vulnerabilities across high and medium severity levels. High-severity issues include two Denial of Service vectors (Server Actions CPU exhaustion and SVG-based Image Optimization abuse), two Server-Side Request Forgery vulnerabilities (in rewrites/redirects and Server Actions on custom servers), and a middleware/proxy bypass affecting Turbopack builds with a single i18n locale. Medium-severity issues cover unbounded Server Action payload memory consumption in Edge runtime, unauthenticated disclosure of internal Server Function endpoint IDs, and two cache confusion bugs in server-side fetch calls with request bodies. All App Router users with Server Actions are urged to update immediately.
