chore(deps): update dependency next to v16.1.7 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
next (source)	16.1.6 → 16.1.7

GitHub Vulnerability Alerts

CVE-2026-27977

Summary

In next dev, cross-site protection for internal websocket endpoints could treat Origin: null as a bypass case even if allowedDevOrigins is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly.

Impact

If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only.
Apps without a configured allowedDevOrigins still allow connections from any origin.

Patches

Fixed by validating Origin: null through the same cross-site origin-allowance checks used for other origins.

Workarounds

If upgrade is not immediately possible:

• Do not expose next dev to untrusted networks.
• Block websocket upgrades to /_next/webpack-hmr when Origin is null at your proxy.

CVE-2026-27978

Summary

origin: null was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests.

Impact

An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF).

Patches

Fixed by treating 'null' as an explicit origin value and enforcing host/origin checks unless 'null' is explicitly allowlisted in experimental.serverActions.allowedOrigins.

Workarounds

If upgrade is not immediately possible:

• Add CSRF tokens for sensitive Server Actions.
• Prefer SameSite=Strict on sensitive auth cookies.
• Do not allow 'null' in serverActions.allowedOrigins unless intentionally required and additionally protected.

CVE-2026-27979

Summary

A request containing the next-resume: 1 header (corresponding with a PPR resume request) would buffer request bodies without consistently enforcing maxPostponedStateSize in certain setups. The previous mitigation protected minimal-mode deployments, but equivalent non-minimal deployments remained vulnerable to the same unbounded postponed resume-body buffering behavior.

Impact

In applications using the App Router with Partial Prerendering capability enabled (via experimental.ppr or cacheComponents), an attacker could send oversized next-resume POST payloads that were buffered without consistent size enforcement in non-minimal deployments, causing excessive memory usage and potential denial of service.

Patches

Fixed by enforcing size limits across all postponed-body buffering paths and erroring when limits are exceeded.

Workarounds

If upgrade is not immediately possible:

• Block requests containing the next-resume header, as this is never valid to be sent from an untrusted client.

CVE-2026-29057

Summary

When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

Impact

An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.

Patches

The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so content-length: 0 is added only when both content-length and transfer-encoding are absent, and transfer-encoding is no longer removed in that code path.

Workarounds

If upgrade is not immediately possible:

• Block chunked DELETE/OPTIONS requests on rewritten routes at your edge/proxy.
• Enforce authentication/authorization on backend routes per our security guidance.

CVE-2026-27980

Summary

The default Next.js image optimization disk cache (/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.

Impact

An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.

Patches

Fixed by adding an LRU-backed disk cache with images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. Setting maximumDiskCacheSize: 0 disables disk caching.

Workarounds

If upgrade is not immediately possible:

• Periodically clean .next/cache/images.
• Reduce variant cardinality (e.g., tighten values for images.localPatterns, images.remotePatterns, and images.qualities)

---

Release Notes

vercel/next.js (next)

v16.1.7

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 14 workspace projects
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 22, reused 0, downloaded 0, added 0
Progress: resolved 24, reused 0, downloaded 0, added 0
e2e                                      |  WARN  deprecated @koa/router@14.0.0
Progress: resolved 33, reused 0, downloaded 0, added 0
Progress: resolved 43, reused 0, downloaded 0, added 0
Progress: resolved 74, reused 0, downloaded 0, added 0
Progress: resolved 85, reused 0, downloaded 0, added 0
Progress: resolved 104, reused 0, downloaded 0, added 0
Progress: resolved 128, reused 0, downloaded 0, added 0
/tmp/renovate/repos/github/mnahkies/openapi-code-generator/packages/documentation:
 ERR_PNPM_NO_MATURE_MATCHING_VERSION  Version 16.1.7 (released 22 hours ago) of @next/swc-linux-x64-musl does not meet the minimumReleaseAge constraint

This error happened while installing the dependencies of next@16.1.7

The latest release of @next/swc-linux-x64-musl is "16.1.7". Published at 3/16/2026 10:56:14 PM

Other releases are:
  * next-12-2-6: 12.2.6 published at 9/29/2022
  * next-14-1: 14.1.1 published at 2/29/2024
  * next-13: 13.5.10 published at 3/24/2025
  * next-12-3-2: 12.3.6 published at 3/24/2025
  * next-14: 14.2.33 published at 9/23/2025
  * next-15-4: 15.4.8 published at 12/3/2025
  * next-15-0: 15.1.9 published at 12/3/2025
  * next-15-0-0: 15.0.5 published at 12/3/2025
  * next-15-5: 15.5.13 published at 3/16/2026 11:00:24 PM
  * canary: 16.2.0-canary.102 published at 3/17/2026 4:47:24 PM

If you need the full list of all 2335 published versions run "pnpm view @next/swc-linux-x64-musl versions".

If you want to install the matched version ignoring the time it was published, you can add the package name to the minimumReleaseAgeExclude setting. Read more about it: https://pnpm.io/settings#minimumreleaseageexclude