Changes Scan Docs Trust

← All changes

When upstream breaks, Teire fixes your code.

teire-dev/teire System status

Built on

Product

Scan a repo Changes Install on GitHub Dashboard Demo video

Developers

Docs GitHub CLI and MCP teire.yml schema npm

Trust

How Teire runs Source code

next (npm) · Teire

Changes Scan Docs Trust

next

npm

latest 16.4.5 · 2026-11-03www.npmjs.com · all 4025 versions

Security advisories54

next: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are usedfixed in 15.5.28, 16.4.1
next: Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routesfixed in 15.5.16, 16.2.5
next: Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Upfixed in 15.5.18, 16.2.6
next: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedfixed in 15.5.24, 16.3.3

Versions that change something

16.0.102025-12fixes 1 advisory
16.0.112026-01fixes 1 advisory
16.1.0-canary.172025-12fixes 1 advisory
16.1.0-canary.192025-12fixes 1 advisory

What each upgrade changes in its API

Changes typesbreaks on upgrade→ 16.4.2· 27 → 16.4.2· 24 → 16.4.2· 62
Deprecates APIsbreaks on upgrade→ 16.4.2· 2 → 16.4.2

next: Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

fixed in 15.5.16, 16.2.5

next: Next.js has information disclosure in development server's Model Context Protocol endpointfixed in 16.3.8

next: Next.js's Middleware / Proxy redirects can be cache-poisonedfixed in 15.5.16, 16.2.5

next: Information exposure in Next.js dev server due to lack of origin verificationfixed in 15.2.2, 14.2.30

next: Next.js: Unbounded next/image disk cache growth can exhaust storagefixed in 16.1.7, 15.5.14

next: Next.js Improper Middleware Redirect Handling Leads to SSRFfixed in 14.2.32, 15.4.7

next: Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequencesfixed in 15.5.21, 16.2.11

next: Next.js has a Middleware / Proxy bypass through dynamic route parameter injectionfixed in 15.5.16, 16.2.5

next: Next.js: Unbounded Server Action payload in Edge runtimefixed in 15.5.21, 16.2.11

next: Next.js has cache poisoning of SSG and ISR pages in self-hosted applicationsfixed in 15.5.27, 16.3.8

next: Next has a Denial of Service with Server Components - Incomplete Fix Follow-Upfixed in 14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, 15.6.0-canary.60, 16.0.10, 16.1.0-canary.19

next: Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arraysfixed in 16.4.1

next: Next.js: Cache confusion of response bodies for requests with bodiesfixed in 15.5.21, 16.2.11

next: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single localefixed in 16.2.11

next: Next.js authorization bypass vulnerabilityfixed in 14.2.15

next: Next.js Allows a Denial of Service (DoS) with Server Actionsfixed in 13.5.8, 14.2.21, 15.1.2

next: Next.js: Server-Side Request Forgery in Server Actions on custom serversfixed in 15.5.21, 16.2.11

next: Next.js Vulnerable to Denial of Service with Server Componentsfixed in 15.5.16, 16.2.5

next: Next.js: Unauthenticated disclosure of internal Server Function endpointsfixed in 15.5.21, 16.2.11

next: Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configurationfixed in 15.5.10, 16.1.5

next: Next.js vulnerable to server-side request forgery in applications using WebSocket upgradesfixed in 15.5.16, 16.2.5

next: Next.js missing cache-control header may lead to CDN caching empty replyfixed in 13.4.20-canary.13

next: Next.js has Server-Side Request Forgery in Image Optimizationfixed in 16.3.8

next: Authorization Bypass in Next.js Middlewarefixed in 13.5.9, 14.2.25, 15.2.3, 12.3.5

next: Next.js has information disclosure in App Router metadata image routes via dynamicParams bypassfixed in 16.3.8

next: Next.js vulnerable to cross-site scripting in App Router applications using CSP noncesfixed in 15.5.16, 16.2.5

next: Next.js Server-Side Request Forgery in Server Actionsfixed in 14.1.1

next: Next.js Affected by Cache Key Confusion for Image Optimization API Routesfixed in 14.2.31, 15.4.5

next: Denial of Service condition in Next.js image optimizationfixed in 14.2.7

next: Next.js: HTTP request smuggling in rewritesfixed in 16.1.7, 15.5.13

next: Next.js Cache Poisoningfixed in 13.5.7, 14.2.10

next: Next.js has cross-site scripting in beforeInteractive scripts with untrusted inputfixed in 15.5.16, 16.2.5

next: Next.js HTTP request deserialization can lead to DoS when using insecure React Server Componentsfixed in 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5

next: Next.js: Unbounded postponed resume buffering can lead to DoSfixed in 16.1.7

next: Next.js has a Denial of Service in the Image Optimization APIfixed in 15.5.16, 16.2.5

next: Next.js: null origin can bypass dev HMR websocket CSRF checksfixed in 16.1.7

next: Next.js: Denial of Service in App Router using Server Actionsfixed in 15.5.21, 16.2.11

next: Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of servicefixed in 16.3.8, 15.5.27

next: Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Componentsfixed in 15.5.16, 16.2.5

next: Next.js: null origin can bypass Server Actions CSRF checksfixed in 16.1.7

next: Next Vulnerable to Denial of Service with Server Componentsfixed in 14.2.34, 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17

next: Next.js: Unauthenticated Remote Code Execution on windows-hosted serversfixed in 15.5.24, 16.3.3

next: Next.js: Denial of Service in App Router using Server Actionsfixed in 15.5.28, 16.4.1

next: Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostnamefixed in 15.5.21, 16.2.11

next: Next.js has a Denial of Service with Server Componentsfixed in 15.5.15, 16.2.3

next: Next.js: Denial of Service in the Image Optimization API using SVGsfixed in 15.5.21, 16.2.11

next: Next.js Race Condition to Cache Poisoningfixed in 14.2.24, 15.1.6

next: Next.js vulnerable to cache poisoning via collisions in React Server Component cache-bustingfixed in 15.5.16, 16.2.5

next: Next.js vulnerable to cache poisoning in React Server Component responsesfixed in 15.5.16, 16.2.5

next: Next.js Content Injection Vulnerability for Image Optimizationfixed in 14.2.31, 15.4.5

16.1.5

2026-01

fixes 2 advisories

16.1.72026-03fixes 5 advisories

16.2.32026-04fixes 1 advisory

16.2.52026-05fixes 12 advisories

16.2.62026-05fixes 1 advisory

16.2.112026-07fixes 9 advisories

16.3.32026-08fixes 2 advisories

16.3.82026-09fixes 5 advisories

16.4.12026-10fixes 3 advisories

16.4.22026-109 changes9 breaking

· 5

→ 16.4.2· 17

Removes APIs●breaks on upgrade→ 16.4.2· 33 → 16.4.2· 35 → 16.4.2· 50

Package deprecated✕security→ ?