Update dependency next to v15.5.21 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	15.5.18 → 15.5.21

---

Next.js: Denial of Service in the Image Optimization API using SVGs

CVE-2026-64644 / GHSA-q8wf-6r8g-63ch

More information

Details

Impact

When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.

• If you are using config.images.remotePatterns, only the patterns in that array are impacted.
• If you are using config.images.unoptimized: true, you are NOT impacted.
• If you are using config.images.loader: 'custom', you are NOT impacted.
• If you are using Vercel, you are NOT impacted.

Workarounds

If you cannot upgrade immediately, you can avoid the expensive work by setting config.experimental.imgOptSkipMetadata : true.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch
• https://github.com/vercel/next.js/pull/96006
• https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c
• https://github.com/vercel/next.js/releases/tag/v15.5.21
• https://github.com/vercel/next.js/releases/tag/v16.2.11
• https://github.com/advisories/GHSA-q8wf-6r8g-63ch

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vercel/next.js (next)

v15.5.21

Compare Source

v15.5.20

Compare Source

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 15.5.15.

v15.5.19: 15.5.19

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [15.5.x] Don't drop FormData entries (#​94244)

Other

• [15.5.x] Fix CI (#​94281)

Credits

Huge thanks to @​eps1lon for helping!

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying selfie with    Cloudflare Pages

Latest commit:	3264f55
Status:	✅  Deploy successful!
Preview URL:	https://d5f80408.selfie-4ye.pages.dev
Branch Preview URL:	https://renovate-npm-next-vulnerabil.selfie-4ye.pages.dev

View logs