[SECURITY][HIGH] Production dependency audit still ships vulnerable Next.js 16.2.3 and transitive high CVEs

[RehanNek]

Severity

High

Summary

The current main branch still ships production dependencies with high-severity advisories. The most security-relevant direct dependency is next@16.2.3, while the current GitHub/npm audit database marks multiple Next.js 16.x advisories as fixed only in >=16.2.5 or >=16.2.6.

This app uses Next.js middleware for security-relevant controls such as host gating, blocklisted markets, admin-route handling, rate limiting, and security headers. Because several of the outstanding Next.js advisories are middleware/proxy bypasses, this should be treated as a high-priority production dependency remediation.

I am not claiming a separate app-specific exploit chain for every transitive package listed below. The reproducible finding is that the production dependency graph currently fails high-severity audit, including direct next advisories affecting security-sensitive middleware/proxy behavior.

Affected versions in the repo

Current main at commit 68911d3:

• app/package.json pins next to 16.2.3.
• app/package.json pins eslint-config-next to 16.2.3.
• pnpm-lock.yaml resolves next@16.2.3.
• package.json currently has overrides for several older advisories, but not the new high advisories below.

Duplicate check

I checked existing issues/PRs before filing:

• Existing closed issue #1421 / merged PR #1422 covered an older dependency audit set from March 2026.
• No open issue or PR was found for the current next@16.2.3 high advisories or the current pnpm audit --prod output.

Proof of Concept

Run from a clean checkout of dcccrypto/percolator-launch on current main:

git checkout main
git pull --ff-only
pnpm audit --audit-level high --prod

Actual result:

54 vulnerabilities found
Severity: 5 low | 32 moderate | 17 high (1 ignored)

High-severity production advisories reported by pnpm audit include:

fast-uri <=3.1.0: path traversal via percent-encoded dot segments
Patched: >=3.1.1
GHSA-q3j6-qgpj-74h6

fast-uri <=3.1.1: host confusion via percent-encoded authority delimiters
Patched: >=3.1.2
GHSA-v39h-62p7-jpjc

next >=16.0.0 <16.2.5: Denial of Service with Server Components
Patched: >=16.2.5
GHSA-8h8q-6873-q5fj

next >=16.0.0 <16.2.6: Middleware / Proxy bypass in App Router via segment-prefetch routes, incomplete fix follow-up
Patched: >=16.2.6
GHSA-26hh-7cqf-hhc6

next >=16.0.0 <16.2.5: Denial of Service via connection exhaustion in Cache Components
Patched: >=16.2.5
GHSA-mg66-mrh9-m8jx

next >=16.0.0 <16.2.5: SSRF in applications using WebSocket upgrades
Patched: >=16.2.5
GHSA-c4j6-fc7j-m34r

next >=16.0.0 <16.2.5: Middleware / Proxy bypass through dynamic route parameter injection
Patched: >=16.2.5
GHSA-492v-c6pp-mqqv

next >=16.0.0 <16.2.5: Middleware / Proxy bypass in App Router via segment-prefetch routes
Patched: >=16.2.5
GHSA-267c-6grr-h53f

next >=16.0.0 <16.2.5: Middleware / Proxy bypass in Pages Router applications using i18n
Patched: >=16.2.5
GHSA-36qx-fr4f-26g5

js-cookie <=3.0.5: cookie-attribute injection via prototype hijack
Patched: >=3.0.7
GHSA-qjx8-664m-686j

ws >=8.0.0 <8.21.0: Memory exhaustion DoS from tiny fragments and data chunks
Patched: >=8.21.0
GHSA-96hv-2xvq-fx4p

ws >=7.0.0 <7.5.11: Memory exhaustion DoS from tiny fragments and data chunks
Patched: >=7.5.11
GHSA-96hv-2xvq-fx4p

form-data >=4.0.0 <4.0.6: CRLF injection via unescaped multipart field names and filenames
Patched: >=4.0.6
GHSA-hmw2-7cc7-3qxx

hono <4.12.25: CORS middleware reflects any Origin with credentials when origin defaults to wildcard
Patched: >=4.12.25
GHSA-88fw-hqm2-52qc

Version checks from the npm registry confirm patched package versions are available:

npm view next version
npm view eslint-config-next@16.2.9 version
npm view fast-uri@3.1.2 version
npm view js-cookie@3.0.7 version
npm view ws@7.5.11 version
npm view ws@8.21.0 version
npm view form-data@4.0.6 version
npm view hono@4.12.25 version

Observed output:

16.2.9
16.2.9
3.1.2
3.0.7
7.5.11
8.21.0
4.0.6
4.12.25

Why this matters for Launch

The app has a security-sensitive Next middleware layer in app/middleware.ts, including:

• waitlist/admin host flow handling,
• blocklisted market enforcement,
• API rate limiting,
• security headers and CSP nonce handling.

Leaving the app on a Next.js version with known middleware/proxy bypass advisories risks those controls being skipped in affected request shapes. The DoS and SSRF advisories also apply to the framework layer that handles incoming requests before app route code.

Suggested fix

• Upgrade next and eslint-config-next from 16.2.3 to the current patched 16.2 patch line, 16.2.9.
• Add pnpm overrides for the audited transitive high advisories that are not directly controlled by app imports:
  • fast-uri >=3.1.2
  • js-cookie >=3.0.7
  • form-data >=4.0.6
  • hono >=4.12.25
  • ws patched for both 7.x and 8.x ranges (7.5.11 and 8.21.0 respectively)
• Regenerate pnpm-lock.yaml.
• Re-run pnpm audit --audit-level high --prod and the app build/test checks.

I will open a separate PR linked to this issue with the dependency-only remediation.

[RehanNek]

Fix PR opened: #2221

[dcccrypto]

Still live when I checked — and not for the versions you named. Direct advisory now FIXED in PR #2526; the transitive tail stays open.

The direct dependency ✅

next had already moved 16.2.3 → 16.2.9, so the advisories you cited (fixed in >=16.2.5 / >=16.2.6) were behind us. But the issue was not stale: newer 16.x advisories have since landed with a fix version of >=16.2.11, so next was still the one direct production dependency failing a high-severity audit — just for different CVEs than the ones in the report.

That is worth noting as a pattern: a dependency-advisory issue can be simultaneously out of date in its specifics and correct in its conclusion. Closing it on "we're past 16.2.6 now" would have been wrong.

Bumped to 16.2.11. Verified after: typecheck clean, suite 3094 passed / 16 skipped / 0 failed, next build completes. next high/critical advisories: 0.

Your severity argument is the reason this got a real verification pass rather than a version bump on trust:

This app uses Next.js middleware for security-relevant controls such as host gating, blocklisted markets, admin-route handling, rate limiting, and security headers. Because several of the outstanding Next.js advisories are middleware/proxy bypasses, this should be treated as a high-priority production dependency remediation.

A middleware bypass in this app is a bypass of those specific controls, not a generic framework CVE.

The transitive tail ⏸️ — open

The production graph still reports 20 high findings, all transitive: nanoid, postcss, browserslist, undici, image-size, sharp, socket.io-parser, fast-uri, ip-address — arriving mostly through @privy-io/react-auth and the build toolchain.

Not bundled in, and I want to be explicit about why rather than leave it looking like an oversight. Each needs either an upstream release or a pnpm override, and an override that forces a version the parent was not tested against can break the wallet path — which is exactly the code you least want to fix blind in a security bump. That is a deliberate pass with its own verification, not a line in this commit.

Your own scoping anticipated this and was the right call:

I am not claiming a separate app-specific exploit chain for every transitive package listed below.

Open for the transitive tail.

[dcccrypto]

Direct advisory FIXED and merged in PR #2527. The transitive tail stays open — retitling my verdict, not closing the issue.

Actually closing this, and here is why the direct half is genuinely done: next is now 16.2.11 on playground, and next high/critical advisories are 0.

The issue was still live when I checked, but not for the versions it named. next had already moved 16.2.3 → 16.2.9, past the advisories cited (fixed in ≥16.2.5 / ≥16.2.6). Newer 16.x advisories had since landed requiring ≥16.2.11. Closing this as stale on "we're past 16.2.6 now" would have been wrong — the specifics were out of date and the conclusion was not.

Verified after the bump: typecheck clean, suite 3111 passed / 16 skipped / 0 failed, next build completes.

Your severity argument is why this got a real verification pass rather than a version bump on trust — a middleware bypass in this app is a bypass of host gating, blocklisted markets, admin routes, rate limiting and security headers specifically, not a generic framework CVE.

The transitive tail — tracked separately

20 high-severity findings remain, all transitive: nanoid, postcss, browserslist, undici, image-size, sharp, socket.io-parser, fast-uri, ip-address — mostly via @privy-io/react-auth and the build toolchain. Each needs an upstream release or a pnpm override, and an override forcing a version the parent was not tested against can break the wallet path. That is a deliberate pass with its own verification, not a line in a security bump — filed as its own issue rather than left buried in this one, so it does not read as "next was fixed, therefore dependencies are fine."

Your own scoping anticipated exactly this:

I am not claiming a separate app-specific exploit chain for every transitive package listed below.