fix(deps): patch critical Next.js RCE and Auth.js advisories

[polylane]

Fixes: Critical Next.js RCE unpatched in production useSend web app

The web and marketing apps pinned a Next.js release with a known unauthenticated remote code execution that the public image optimizer exposes, together with critical Auth.js advisories. Automated security updates are disabled, so no fix pull request existed. Both apps now use patched releases and the vulnerable code no longer ships.

flowchart LR
  U["Internet client"] -->|"GET /_next/image"| O["Image optimizer (public in apps/web)"]
  O --> P["Next.js 15.5.18 image pipeline"]
  P -.->|"advisory: unauthenticated RCE"| R["Server code execution"]
  F["Fix: next 15.5.27, next-auth 4.24.15, adapter 2.11.3"] -->|"removes vulnerable code"| P

Loading

Detection evidence

Affected: int_13ee3c91c001c2c8xfdj06a9

Why this fix

The frozen lockfile that Railway deploys resolves the pinned Next.js release, and the advisory names 15.5.24 as the first fixed version; the web app enables the image optimizer, so that endpoint is public. Raising the pins to patched releases removes the vulnerable code from the built image. Exploitation by an arbitrary external client is not confirmed because remote image sources are restricted, and enabling Dependabot security updates remains a repository setting a maintainer must change.

flowchart LR
  U["Internet client"] -->|"GET /_next/image"| O["Image optimizer (public in apps/web)"]
  O --> P["Next.js 15.5.18 image pipeline"]
  P -.->|"advisory: unauthenticated RCE"| R["Server code execution"]
  F["Fix: next 15.5.27, next-auth 4.24.15, adapter 2.11.3"] -->|"removes vulnerable code"| P

Loading

Out of scope

• The other open high and medium dependency advisories (57 high, 70 medium); this change covers the critical ones.
• Enabling Dependabot security updates and secret scanning: repository settings a maintainer must change, not code.

Causal chain

• Signal (alert): Critical Dependabot alerts: GHSA-2xp9-vwfh-vxw4 / GHSA-p293-qw3h-jr36 (next < 15.5.24) and GHSA-7rqj-j65f-68wh (next-auth < 4.24.15, @auth/core < 0.41.3)
• Surfacing site: usesend/useSend at usesend/useSend:apps/web/package.json#dependencies
• Mechanism: The deployed web app runs the pinned Next.js 15.5.18 and exposes the image optimization API publicly; the AVIF path is reachable without authentication, and the pinned next-auth/@auth/core releases carry the critical email-normalization advisory.
• Producer: usesend/useSend application dependencies (next, next-auth, @auth/prisma-adapter), at usesend/useSend:apps/web/package.json#dependencies
• Trigger: Dependabot alerts for the Next.js and Auth.js advisories first opened 2026-09-08 and no fix pull request exists because automated security updates are disabled.
• Blast radius: unknown other resource(s), unknown other tenant(s); data at risk: none named
• Producer evidence:
  • pnpm-lock.yaml resolves next@15.5.18, next-auth@4.24.14, @auth/core@0.41.2
  • nixpacks.toml / docker/Dockerfile deploy with pnpm i --frozen-lockfile
  • apps/web enables the image optimizer (next/image used, no images.unoptimized)

3 files changed (+109/-110)

• apps/marketing/package.json: modified, +4/-4
• apps/web/package.json: modified, +5/-5
• pnpm-lock.yaml: modified, +100/-101

Repository lint: pnpm run lint (declared in package.json) fails over the whole repository (the declared target takes no file arguments), so the failure is not attributed to this change and did not block it; run it before merging.

Lint output

field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides". See https://pnpm.io/settings for the new home of each setting.
@usesend/lib:lint: $ eslint . --max-warnings 0
usesend-js:lint: cache miss, executing 2b48c7c6e12d1991
usesend-js:lint: [WARN] The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides". See https://pnpm.io/settings for the new home of each setting.
usesend-js:lint: $ eslint . --max-warnings 0
usesend-js:lint: sh: 1: eslint: not found
usesend-js:lint: [ELIFECYCLE] Command failed.
@usesend/ui:lint: [ELIFECYCLE] Command failed.

 Tasks:    1 successful, 3 total
Cached:    0 cached, 3 total
  Time:    4.11s 
Failed:    usesend-js#lint

[ELIFECYCLE] Command failed with exit code 1.
[WARN] The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides". See https://pnpm.io/settings for the new home of each setting.
$ turbo lint

Attention:
Turborepo now collects completely anonymous telemetry regarding usage.
This information is used to shape the Turborepo roadmap and prioritize features.
You can learn more, including how to opt-out if you'd not like to participate in this anonymous program, by visiting the following URL:
https://turborepo.dev/docs/telemetry

• turbo 2.10.4
usesend-js#lint:  ERROR  command (/workspace/usesend/useSend/packages/sdk) /usr/local/bin/pnpm run lint exited (1)
 ERROR  run failed: command  exited (1)

---

Generated by Polylane. You can ask follow-ups by mentioning @polylane in a comment.

---

Summary by cubic

Patches critical Next.js and Auth.js advisories by raising dependency pins, so the vulnerable image optimizer and email-normalization code no longer ships.

• The web and marketing apps move from next 15.5.18 to 15.5.27, with next-auth to 4.24.15 and @auth/prisma-adapter to 2.11.3; matching Next tooling (@next/mdx, eslint-config-next, @next/eslint-plugin-next) follows.
• The web app's public image optimizer endpoint was reachable in the pinned releases (unauthenticated RCE); exploitation is not confirmed because remote image sources are restricted.
• This change covers only the critical advisories; the 57 high and 70 medium advisories remain open, and enabling Dependabot security updates is a repository setting a maintainer must change.
• Repo-wide lint fails before and after this change, so it is not attributed to this diff; run pnpm run lint before merging.

^{Written for commit d7a5220. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
unsend-marketing	Ready	Preview	Oct 15, 2026 9:46am UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: dc55c73c-6bf1-43fa-8afe-e2193f7cc9fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying usesend with    Cloudflare Pages

Latest commit:	d7a5220
Status:	✅  Deploy successful!
Preview URL:	https://549c3ae8.usesend.pages.dev
Branch Preview URL:	https://polylane-autofix-7p23geabwwf.usesend.pages.dev

View logs

[polylane]

Tip

Expected to resolve the linked issue.

Linked issue: iss_13ee73559001hu4dkwtptfto — Critical Next.js RCE unpatched in production useSend web app

Checked the deployed unsend service (Standard tier, one replica, healthy): CPU 0.013 vCPU mean against a 32 vCPU limit over 72h, and zero /_next/image requests in log retention. Every manifest matches the regenerated lockfile, so the frozen-lockfile deploy installs.

View the full analysis →

Also considered · 3 refuted

• Refuted · Frozen-lockfile install fails on the next deploy, so the patched versions never ship · Every manifest declaring the changed packages was updated in the same diff and matches its lockfile importer entry (next 15.5.27, next-auth ^4.24.15, @auth/prisma-adapter ^2.11.3, @next/mdx and eslint-config-next ^15.5.27).
• Refuted · Lockfile regeneration moves unrelated image dependencies into the deployed image · ico-endec is transitive docs tooling (favicons@7.2.0 keeps sharp 0.33.5), the deployed service builds only @usesend/email-editor and web, and the framework's own sharp stays at 0.34.5.
• Refuted · The Next.js patch release changes the deployed web app's runtime behaviour · No behaviour change is pointable in the resulting code: the app's own source is untouched and it consumes Next only through public entry points (32 import sites across next/image, next/server, next/headers, next/navigation).

Dependency changes

Package	Change	Jump	Release age
@auth/prisma-adapter	2.9.0 → 2.11.3	minor	2 months
@next/eslint-plugin-next	15.5.18 → 15.5.27	patch	14 days
@next/mdx	15.5.18 → 15.5.27	patch	14 days
eslint-config-next	15.5.18 → 15.5.27	patch	14 days
next	15.5.18 → 15.5.27	patch	14 days
next-auth	4.24.14 → 4.24.15	patch	2 months
@auth/core (lockfile)	0.41.2 → 0.41.3	patch	—
@img/colour (lockfile)	removed (was 1.1.0)	—	—
@next/env (lockfile)	15.5.18 → 15.5.27	patch	—
@next/swc-darwin-arm64 (lockfile)	15.5.18 → 15.5.27	patch	—
@next/swc-darwin-x64 (lockfile)	15.5.18 → 15.5.27	patch	—
@next/swc-linux-arm64-gnu (lockfile)	15.5.18 → 15.5.27	patch	—
@next/swc-linux-arm64-musl (lockfile)	15.5.18 → 15.5.27	patch	—
@next/swc-linux-x64-gnu (lockfile)	15.5.18 → 15.5.27	patch	—
@next/swc-linux-x64-musl (lockfile)	15.5.18 → 15.5.27	patch	—
@next/swc-win32-arm64-msvc (lockfile)	15.5.18 → 15.5.27	patch	—
@next/swc-win32-x64-msvc (lockfile)	15.5.18 → 15.5.27	patch	—
uuid (lockfile)	removed (was 8.3.2)	—	—

Analysed against 1 Service and 1 repository

• Service: unsend
• Repository: usesend/useSend

_{Polylane analysed d7a5220 for production impact. You can ask follow-ups by mentioning @polylane in a comment.}

Did this help? React 👍 or 👎 so the next review is sharper.