fix(deps): update dependency next to v14 [security]

[svc-secops]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
next (source)	13.3.1 -> 14.2.35

GitHub Vulnerability Alerts

CVE-2023-46298

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.

CVE-2024-47831

Impact

The image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption.

Not affected:

• The next.config.js file is configured with images.unoptimized set to true or images.loader set to a non-default value.
• The Next.js application is hosted on Vercel.

Patches

This issue was fully patched in Next.js 14.2.7. We recommend that users upgrade to at least this version.

Workarounds

Ensure that the next.config.js file has either images.unoptimized, images.loader or images.loaderFile assigned.

Credits

Brandon Dahler (brandondahler), AWS
Dimitrios Vlastaras

CVE-2024-39693

Impact

A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server.

This vulnerability can affect all Next.js deployments on the affected versions.

Patches

This vulnerability was resolved in Next.js 13.5 and later. We recommend that users upgrade to a safe version.

Workarounds

There are no official workarounds for this vulnerability.

Credit

• Thai Vu of flyseccorp.com
• Aonan Guan (@​0dd), Senior Cloud Security Engineer

CVE-2024-51479

Impact

If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.

Patches

This issue was patched in Next.js 14.2.15 and later.

If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

We'd like to thank tyage (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.

CVE-2024-56332

Impact

A Denial of Service (DoS) attack allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution.

Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time.

Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing.

This is the same issue as if the incoming HTTP request has an invalid Content-Length header or never closes. If the host has no other mitigations to those then this vulnerability is novel.

This vulnerability affects only Next.js deployments using Server Actions.

Patches

This vulnerability was resolved in Next.js 14.2.21, 15.1.2, and 13.5.8. We recommend that users upgrade to a safe version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

Thanks to the PackDraw team for responsibly disclosing this vulnerability.

CVE-2025-29927

Impact

It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.

Patches

• For Next.js 15.x, this issue is fixed in 15.2.3
• For Next.js 14.x, this issue is fixed in 14.2.25
• For Next.js 13.x, this issue is fixed in 13.5.9
• For Next.js 12.x, this issue is fixed in 12.3.5
• For Next.js 11.x, consult the below workaround.

Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability.

Workaround

If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application.

Credits

• Allam Rachid (zhero;)
• Allam Yasser (inzo_)

CVE-2025-48068

Summary

A low-severity vulnerability in Next.js has been fixed in version 15.2.2. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active.

Because the mitigation is potentially a breaking change for some development setups, to opt-in to the fix, you must configure allowedDevOrigins in your next config after upgrading to a patched version. Learn more.

Learn more: https://vercel.com/changelog/cve-2025-48068

Credit

Thanks to sapphi-red and Radman Siddiki for responsibly disclosing this issue.

CVE-2025-57752

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.

All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.

More details at Vercel Changelog

CVE-2025-57822

A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.

All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.

More details at Vercel Changelog

CVE-2025-55173

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.

All users relying on images.domains or images.remotePatterns are encouraged to upgrade and verify that external image sources are strictly validated.

More details at Vercel Changelog

CVE-2025-32421

Summary
We received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps data instead of standard HTML.

Learn more here

Credit
Thank you to Allam Rachid (zhero) for the responsible disclosure. This research was rewarded as part of our bug bounty program.

GHSA-mwv6-3258-q52c

A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55184.

A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.

GHSA-5j59-xgg2-r9c4

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and did not fully prevent denial-of-service attacks in all payload types. This affects React package versions 19.0.2, 19.1.3, and 19.2.2 and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-67779.

A malicious HTTP request can be crafted and sent to any Server Function endpoint that, when deserialized, can enter an infinite loop within the React Server Components runtime. This can cause the server process to hang and consume CPU, resulting in denial of service in unpatched environments.

---

Next.js missing cache-control header may lead to CDN caching empty reply

CVE-2023-46298 / GHSA-c59h-r6p8-q9wc

More information

Details

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.

Severity

Low

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-46298
• https://github.com/vercel/next.js/issues/45301
• https://github.com/vercel/next.js/pull/54732
• https://github.com/vercel/next.js/commit/20d05958ff853e9c9e42139ffec294336881c648
• https://github.com/vercel/next.js
• https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Next.js Denial of Service (DoS) condition

CVE-2024-39693 / GHSA-fq54-2j52-jc42

More information

Details

Impact

A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server.

This vulnerability can affect all Next.js deployments on the affected versions.

Patches

This vulnerability was resolved in Next.js 13.5 and later. We recommend that users upgrade to a safe version.

Workarounds

There are no official workarounds for this vulnerability.

Credit

• Thai Vu of flyseccorp.com
• Aonan Guan (@​0dd), Senior Cloud Security Engineer

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/vercel/next.js/security/advisories/GHSA-fq54-2j52-jc42
• https://nvd.nist.gov/vuln/detail/CVE-2024-39693
• https://github.com/vercel/next.js

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Next.js Allows a Denial of Service (DoS) with Server Actions

CVE-2024-56332 / GHSA-7m27-7ghc-44w9

More information

Details

Impact

A Denial of Service (DoS) attack allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution.

Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time.

Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing.

This is the same issue as if the incoming HTTP request has an invalid Content-Length header or never closes. If the host has no other mitigations to those then this vulnerability is novel.

This vulnerability affects only Next.js deployments using Server Actions.

Patches

This vulnerability was resolved in Next.js 14.2.21, 15.1.2, and 13.5.8. We recommend that users upgrade to a safe version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

Thanks to the PackDraw team for responsibly disclosing this vulnerability.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/vercel/next.js/security/advisories/GHSA-7m27-7ghc-44w9
• https://nvd.nist.gov/vuln/detail/CVE-2024-56332
• https://github.com/vercel/next.js

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Authorization Bypass in Next.js Middleware

CVE-2025-29927 / GHSA-f82v-jwr5-mffw

More information

Details

Impact

It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.

Patches

• For Next.js 15.x, this issue is fixed in 15.2.3
• For Next.js 14.x, this issue is fixed in 14.2.25
• For Next.js 13.x, this issue is fixed in 13.5.9
• For Next.js 12.x, this issue is fixed in 12.3.5
• For Next.js 11.x, consult the below workaround.

Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability.

Workaround

If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application.

Credits

• Allam Rachid (zhero;)
• Allam Yasser (inzo_)

Severity

• CVSS Score: 9.1 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
• https://nvd.nist.gov/vuln/detail/CVE-2025-29927
• https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2
• https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48
• https://github.com/vercel/next.js
• https://github.com/vercel/next.js/releases/tag/v12.3.5
• https://github.com/vercel/next.js/releases/tag/v13.5.9
• https://security.netapp.com/advisory/ntap-20250328-0002
• https://vercel.com/changelog/vercel-firewall-proactively-protects-against-vulnerability-with-middleware
• http://www.openwall.com/lists/oss-security/2025/03/23/3
• http://www.openwall.com/lists/oss-security/2025/03/23/4

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Denial of Service condition in Next.js image optimization

CVE-2024-47831 / GHSA-g77x-44xx-532m

More information

Details

Impact

The image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption.

Not affected:

• The next.config.js file is configured with images.unoptimized set to true or images.loader set to a non-default value.
• The Next.js application is hosted on Vercel.

Patches

This issue was fully patched in Next.js 14.2.7. We recommend that users upgrade to at least this version.

Workarounds

Ensure that the next.config.js file has either images.unoptimized, images.loader or images.loaderFile assigned.

Credits

Brandon Dahler (brandondahler), AWS
Dimitrios Vlastaras

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m
• https://nvd.nist.gov/vuln/detail/CVE-2024-47831
• https://github.com/vercel/next.js/commit/d11cbc9ff0b1aaefabcba9afe1e562e0b1fde65a
• https://github.com/vercel/next.js

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Next.js authorization bypass vulnerability

CVE-2024-51479 / GHSA-7gfc-8cq8-jh5f

More information

Details

Impact

If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.

Patches

This issue was patched in Next.js 14.2.15 and later.

If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

We'd like to thank tyage (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f
• https://nvd.nist.gov/vuln/detail/CVE-2024-51479
• https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b
• https://github.com/vercel/next.js
• https://github.com/vercel/next.js/releases/tag/v14.2.15

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Next.js Race Condition to Cache Poisoning

CVE-2025-32421 / GHSA-qpjv-v59x-3qc4

More information

Details

Summary
We received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps data instead of standard HTML.

Learn more here

Credit
Thank you to Allam Rachid (zhero) for the responsible disclosure. This research was rewarded as part of our bug bounty program.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-qpjv-v59x-3qc4
• https://nvd.nist.gov/vuln/detail/CVE-2025-32421
• https://github.com/vercel/next.js
• https://vercel.com/changelog/cve-2025-32421

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Next.js Content Injection Vulnerability for Image Optimization

CVE-2025-55173 / GHSA-xv57-4mr9-wg8v

More information

Details

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.

All users relying on images.domains or images.remotePatterns are encouraged to upgrade and verify that external image sources are strictly validated.

More details at Vercel Changelog

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v
• https://nvd.nist.gov/vuln/detail/CVE-2025-55173
• https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
• https://github.com/vercel/next.js
• https://vercel.com/changelog/cve-2025-55173
• http://vercel.com/changelog/cve-2025-55173

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Next.js Affected by Cache Key Confusion for Image Optimization API Routes

CVE-2025-57752 / GHSA-g5qg-72qw-gw5v

More information

Details

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.

All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.

More details at Vercel Changelog

Severity

• CVSS Score: 6.2 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v
• https://nvd.nist.gov/vuln/detail/CVE-2025-57752
• https://github.com/vercel/next.js/pull/82114
• https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
• https://github.com/vercel/next.js
• https://vercel.com/changelog/cve-2025-57752

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Next.js Improper Middleware Redirect Handling Leads to SSRF

CVE-2025-57822 / GHSA-4342-x723-ch2f

More information

Details

A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.

All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.

More details at Vercel Changelog

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f
• https://nvd.nist.gov/vuln/detail/CVE-2025-57822
• https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8
• https://github.com/vercel/next.js
• https://vercel.com/changelog/cve-2025-57822

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Next Vulnerable to Denial of Service with Server Components

GHSA-mwv6-3258-q52c

More information

Details

A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55184.

A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c
• https://github.com/vercel/next.js
• https://nextjs.org/blog/security-update-2025-12-11
• https://www.cve.org/CVERecord?id=CVE-2025-55184

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

GHSA-5j59-xgg2-r9c4

More information

Details

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and did not fully prevent denial-of-service attacks in all payload types. This affects React package versions 19.0.2, 19.1.3, and 19.2.2 and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-67779.

A malicious HTTP request can be crafted and sent to any Server Function endpoint that, when deserialized, can enter an infinite loop within the React Server Components runtime. This can cause the server process to hang and consume CPU, resulting in denial of service in unpatched environments.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/vercel/next.js/security/advisories/GHSA-5j59-xgg2-r9c4
• https://nvd.nist.gov/vuln/detail/CVE-2025-67779
• https://github.com/vercel/next.js
• https://nextjs.org/blog/security-update-2025-12-11
• https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
• https://www.cve.org/CVERecord?id=CVE-2025-55184
• https://www.facebook.com/security/advisories/cve-2025-67779

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vercel/next.js (next)

v14.2.35

Compare Source

Please see the Next.js Security Update for information about this security patch.

v14.2.34

Compare Source

v14.2.33

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• omit searchParam data from FlightRouterState before transport (#​80734)

Credits

Huge thanks to @​ztanner for helping!

v14.2.32

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix router handling when setting a location response header #​82588

Credits

Huge thanks to @​ztanner for helping!

v14.2.31

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix(next/image): improve and simplify detect-content-type (#​82179)
• fix(next/image): fix image-optimizer.ts headers (#​82178)

Credits

Huge thanks to @​styfle and @​ztanner for helping!

v14.2.30

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Backport config.allowedDevOrigins (#​80410) (Learn More)

Credits

Huge thanks to @​ijjk and @​ztanner for helping!

v14.2.29

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Only share incremental cache for edge in next start (#​79389)

Credits

Huge thanks to @​ijjk for helping!

v14.2.28

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix: node.js module import error when using middleware (#​77945)

Credits

Huge thanks to @​ztanner for helping!

v14.2.27

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix dynamic route interception not working when deployed with middleware (#​64923)

Credits

Huge thanks to @​ztanner for helping!

v14.2.26

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Match subrequest handling for edge and node (#​77476)

v14.2.25

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.
This release contains a security patch for CVE-2025-29927.

Core Changes

• Update middleware request header (#​77202)

Credits

Huge thanks to @​ijjk for helping!

v14.2.24

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix: ensure lint worker errors aren't silenced (#​75779)
• add additional x-middleware-set-cookie filtering (#​75561 & #​73482)

Credits

Huge thanks to @​ztanner for helping!

v14.2.23

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• backport: force module format for virtual client-proxy (#​74590)
• Backport: Use provided waitUntil for pending revalidates (#​74573)
• Feature: next/image: add support for images.qualities in next.config (#​74500)

Credits

Huge thanks to @​styfle, @​ijjk and @​lubieowoce for helping!

v14.2.22

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Retry manifest file loading only in dev mode: #​73900
• Ensure workers are cleaned up: #​71564
• Use shared worker for lint & typecheck steps: #​74154

Credits

Huge thanks to @​unstubbable, @​ijjk, and @​ztanner for helping!

v14.2.21

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Upgrade React from 14898b6 to 178c267: https://github.com/vercel/next.js/pull/74115
• Fix unstable_allowDynamic when used with pnpm:https://github.com/vercel/next.js/pull/737655

Misc Changes

• chore(docs): add missing search: '' on remotePatterns: https://github.com/vercel/next.js/pull/73927
• chore(docs): update version history of next/image: https://github.com/vercel/next.js/pull/73926

Credits

Huge thanks to @​unstubbable, @​ztanner, and @​styfle for helping!

v14.2.20

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Fix fetch cloning bug (https://github.com/vercel/next.js/pull/73532)

Credits

Huge thanks to @​wyattjoh for helping!

v14.2.19

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• ensure worker exits bubble to parent process (#​73433)
• Increase max cache tags to 128 (#​73125)

Misc Changes

• Update max tag items limit in docs (#​73445)

Credits

Huge thanks to @​ztanner and @​ijjk for helping!

v14.2.18

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Fix: (third-parties) sendGTMEvent not queueing events before GTM init (#​68683) (#​72111)
• Ignore error pages for cache revalidate (#​72412) (#​72484)

Credits

Huge thanks to @​huozhi and @​ijjk for helping!

v14.2.17

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Fix: revert the bad node binary handling (#​72356)
• Ensure pages/500 handles cache-control as expected (#​72050) (#​72110)
• fix unhandled runtime error from generateMetadata in parallel routes (#​72153)

Credits

Huge thanks to @​huozhi, @​ztanner, and @​ijjk for helping!

v14.2.16

Compare Source

v14.2.15

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• support breadcrumb style catch-all parallel routes #​65063
• Provide non-dynamic segments to catch-all parallel routes #​65233
• Fix client reference access causing metadata missing #​70732
• feat(next/image): add support for decoding prop #​70298
• feat(next/image): add images.localPatterns config #​70529
• fix(next/image): handle undefined images.localPatterns config in images-manifest.json
• fix: Do not omit alt on getImgProps return type, ImgProps #​70608
• [i18n] Routing fix #​70761

Credits

Huge thanks to @​ztanner, @​agadzik, @​huozhi, @​styfle, @​icyJoseph and @​wyattjoh for helping!

v14.2.14

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Fix: clone response in first handler to prevent race (#​70082) (#​70649)
• Respect reexports from metadata API routes (#​70508) (#​70647)
• Externalize node binary modules for app router (#​70646)
• Fix revalidateTag() behaviour when invoked in server components (#​70446) (#​70642)
• Fix prefetch bailout detection for nested loading segments (#​70618)
• Add missing node modules to externals (#​70382)
• Feature: next/image: add support for images.remotePatterns.search (#​70302)

Credits

Huge thanks to @​styfle, @​ztanner, @​ijjk, @​huozhi and @​wyattjoh for helping!

v14.2.13

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Fix missing cache-control on SSR app route (#​70265)
• feat: add polyfill of URL.canParse for browser compatibility (#​70228)
• Fix vercel og package memory leak (#​70214)
• Fix startTime error on Android 9 with Chrome 74 (#​67391)

Credits

Huge thanks to @​raeyoung-kim, @​huozhi, @​devjiwonchoi, and @​ijjk for helping!

v14.2.12

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• update prefetching jsdoc & documentation (#​68047)
• Ensure we chunk revalidate tag requests (#​70189)
• (backport) fix(eslint): allow typescript-eslint v8 (#​70090)
• [ppr] Don't mark RSC requests as /_next/data requests (backport of #​66249) (#​70083)

Credits

Huge thanks to @​alvarlagerlof, @​wyattjoh, @​delbaoliveira, and @​ijjk for helping!

v14.2.11

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix: correct metadata url suffix (https://github.com/vercel/next.js/pull/69959)
• fix: setting assetPrefix to URL format breaks HMR (#​70040)
• Update revalidateTag to batch tags in one request (#​65296)

Credits

Huge thanks to @​huozhi, @​devjiwonchoi, and @​ijjk for helping!

v14.2.10

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Remove invalid fallback revalidate value (https://github.com/vercel/next.js/pull/69990)
• Revert server action optimization (https://github.com/vercel/next.js/pull/69925)
• Add ability to customize Cache-Control (#​69802)

Credits

Huge thanks to @​huozhi and @​ijjk for helping!

v14.2.9

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Revert "Fix esm property def in flight loader (#​66990)" (#​69749)
• Disable experimental.optimizeServer by default to fix failed server action (#​69788)
• Fix middleware fallback: false case (#​69799)
• Fix status code for /_not-found route (#​64058) (#​69808)
• Fix metadata prop merging (#​69807)
• create-next-app: fix font file corruption when using import alias (#​69806)

Credits

Huge thanks to @​huozhi, @​ztanner, @​ijjk, and @​lubieowoce for helping!

v14.2.8

Compare Source

What's Changed

[!NOTE]
This release is backporting bug fixes and minor improvements. It does not include all pending features/changes on canary.

Support esmExternals in app directory

• Support esm externals in app router (#​65041)
• Turbopack: Allow client components from foreign code in app routes (#​64751)
• Turbopack: add support for esm externals in app dir (#​64918)
• other related PRs: #​66990 #​66727 #​66286 #​65519

Reading cookies set in middleware in components and actions

• initialize ALS with cookies in middleware (#​65008)
• fix middleware cookie initialization (#​65820)
• ensure cookies set in middleware can be read in a server action (#​67924)
• fix: merged middleware cookies should preserve options (#​67956)

Metadata and icons

• support facebook-specific metadata (fb:app_id, fb:admins) in generateMetaData (#​65713)
• Always collect static icons for all segments (#​68712)
• Fix favicon merging with customized icons (#​67982)
• Warn metadataBase missing in standalone mode or non vercel deployment (#​66296)

Parallel routes fixes

• fix missing stylesheets when parallel routes are present (#​69507)

Draft mode and edge improvements

• fix: unstable_cache should not cache new result in draft mode (#​67772)
• Add draft mode flag for multi-zone (#​68997)
• Fix edge preview props are not matched with cookie (#​67779)
• other related PRs: #​65426, #​67787, #​64946, [#​64313](https://redir

---

Configuration

📅 Schedule: Branch creation - "" in timezone Etc/UTC, Automerge - "after 8am and before 4pm on tuesday" in timezone Etc/UTC.

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

This PR has been generated by Renovate Bot.