Skip to content

fix: patch critical Next.js and Auth.js advisories - #465

Merged
KMKoushik merged 1 commit into
mainfrom
fix/next-auth-security-advisories
Oct 15, 2026
Merged

fix: patch critical Next.js and Auth.js advisories#465
KMKoushik merged 1 commit into
mainfrom
fix/next-auth-security-advisories

Conversation

@KMKoushik

@KMKoushik KMKoushik commented Oct 15, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Member

Summary

Bumps the dependencies flagged by eight open critical Dependabot alerts:

Package From To Advisory
next (apps/web, apps/marketing) 15.5.18 15.5.27 GHSA-2xp9-vwfh-vxw4 (RCE in image optimizer), GHSA-p293-qw3h-jr36 (Windows-only) — fixed in 15.5.24
next-auth 4.24.14 4.24.15 GHSA-7rqj-j65f-68wh
@auth/core (via @auth/prisma-adapter 2.11.3) 0.41.2 0.41.3 GHSA-7rqj-j65f-68wh

apps/web serves /_next/image publicly. remotePatterns only allows gravatar, which limits how the RCE could be reached, but the vulnerable code still ships in the deployed image until this lands. Railway installs with --frozen-lockfile, so the lockfile update is what changes the deployed version.

I picked 15.5.27 over 15.5.28 because 15.5.28 came out on 2026-10-14. That is inside pnpm 11's minimum release age, so installing it would need a minimumReleaseAgeExclude entry.

Found by Polylane (issue: Critical Next.js RCE unpatched in production useSend web app).

Migration notes

None. There are no schema or config changes.

Verification

  • pnpm install --frozen-lockfile: lockfile is consistent
  • pnpm --filter=web typecheck: passes
  • pnpm test:web:unit: 126 passed
  • pnpm test:web:trpc: 10 passed
  • pnpm test:web:api: 20 passed
  • Not run: full pnpm build and integration tests. Please check sign-in (magic link + OAuth) on a preview deploy before merging.

Follow-up

Dependabot security updates are disabled on this repo, which is why no automatic PR was opened for these alerts. Turning it on (or adding .github/dependabot.yml) would catch the next ones.

Summary by cubic

Patches three critical security advisories by bumping next to 15.5.27 (GHSA-2xp9-vwfh-vxw4, GHSA-p293-qw3h-jr36), next-auth to 4.24.15, and @auth/core to 0.41.3 via @auth/prisma-adapter 2.11.3 (GHSA-7rqj-j65f-68wh).

Notes

  • apps/web serves /_next/image publicly but remotePatterns only allows gravatar, limiting how the RCE could be reached; the vulnerable code still ships in the deployed image until this lands.
  • Railway installs with --frozen-lockfile, so the lockfile update is what changes the deployed version.
  • 15.5.27 was chosen over 15.5.28 because 15.5.28 falls inside pnpm 11's minimum release age.
  • No schema or config changes, and no migration is needed.
  • Dependabot security updates are disabled on this repo, so no automatic PR was opened.

Verification

  • pnpm install --frozen-lockfile, typecheck, and 156 unit tests pass.
  • Full pnpm build and integration tests were not run; please verify magic link and OAuth sign-in on a preview deploy before merging.

Written for commit a983d58. Summary will update on new commits.

View guided diff Turn on auto-fix

Summary by CodeRabbit

  • Chores
    • Updated application components as part of routine maintenance.
    • No user-facing features or behavior changes are included in this release.

@KMKoushik
fix: patch critical Next.js and Auth.js advisories
a983d58 
Bump next 15.5.18 -> 15.5.27 (GHSA-2xp9-vwfh-vxw4, GHSA-p293-qw3h-jr36),
next-auth 4.24.14 -> 4.24.15 and @auth/core 0.41.2 -> 0.41.3 via
@auth/prisma-adapter 2.11.3 (GHSA-7rqj-j65f-68wh).
@vercel

vercel Bot commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
unsend-marketing Ready Ready Preview Oct 15, 2026 10:40am UTC

@coderabbitai

coderabbitai Bot commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 01da2020-2a05-4c80-8fbe-2f5bd5f37aa2
📥 Commits

Reviewing files that changed from the base of the PR and between 8f9c64f and a983d58.

⛔ Files ignored due to path filters: 1
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing: 2
  • apps/marketing/package.json
  • apps/web/package.json

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

The marketing app updates next from 15.5.18 to 15.5.27. The web app updates @auth/prisma-adapter from ^2.9.0 to ^2.11.3, next from 15.5.18 to 15.5.27, and next-auth from ^4.24.14 to ^4.24.15.

Priority: ⬆️ High

Change: Bug fix

Merge Risk: ⚪ Minimal · up to a983d

This change updates Next.js and Auth.js to address reported security alerts, and no merge-blocking defect has been confirmed. The deployed Next.js 15.5.27 may still be in the range of a later image-optimizer advisory if Railway runs on glibc. Before merging, confirm the production runtime libc or move to Next.js 15.5.28. Also verify magic-link and OAuth sign-in on a preview deployment, as the description requests.

Pre-merge checks: Passed 5
Passed Passed checks: 5 passed
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly and concisely describes the dependency updates that address critical Next.js and Auth.js security advisories.
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

apps/marketing/package.json

ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.

apps/web/package.json

ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 15, 2026

Copy link
Copy Markdown

Deploying usesend with  Cloudflare Pages  Cloudflare Pages

Latest commit: a983d58
Status: ✅  Deploy successful!
Preview URL: https://4b73e7b3.usesend.pages.dev
Branch Preview URL: https://fix-next-auth-security-advis.usesend.pages.dev

View logs

@KMKoushik
KMKoushik merged commit daaa435 into main Oct 15, 2026
6 checks passed
@KMKoushik
KMKoushik deleted the fix/next-auth-security-advisories branch October 15, 2026 10:54

This branch was successfully deployed

1 active deployment
Preview — a983d586 Deployed Oct 15, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@KMKoushik