Skip to content

Commit 6da5666

Browse files
tomdaletomdale
authored
Merge pull request #32 from vercel-labs/tomdale/16-canary
Update 16.x canary safe version to canary.18
2 parents 9bb63fb + ae1b160 commit 6da5666

6 files changed

Lines changed: 34 additions & 29 deletions

File tree

‎.changeset/fair-animals-peel.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
"fix-react2shell-next": patch
3+
---
4+
5+
Updates 16.x canary safe version to canary.18

‎lib/vulnerabilities/cve-2025-55183.js‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
* - Next.js 15.5.x before 15.5.8
1212
* - Next.js 15.x canary before 15.6.0-canary.59
1313
* - Next.js 16.0.x before 16.0.9
14-
* - Next.js 16.x canary before 16.1.0-canary.17
14+
* - Next.js 16.x canary before 16.1.0-canary.18
1515
* - React RSC packages 19.0.0 through 19.2.1
1616
*
1717
* Note: Next.js 13.x and 14.x are NOT affected by this CVE.
@@ -34,7 +34,7 @@ const NEXT_PATCHED_VERSIONS = {
3434
// Patched canary versions
3535
const NEXT_CANARY_PATCHES = {
3636
15: '15.6.0-canary.59',
37-
16: '16.1.0-canary.17',
37+
16: '16.1.0-canary.18',
3838
};
3939

4040
// React RSC vulnerable versions (19.0.0 through 19.2.1)
@@ -101,7 +101,7 @@ function isNextVulnerable(version) {
101101
// Next.js 16.x
102102
if (major === 16) {
103103
if (isCanary) {
104-
if (compareVersions(raw, '16.1.0-canary.17') >= 0) {
104+
if (compareVersions(raw, '16.1.0-canary.18') >= 0) {
105105
return { vulnerable: false, reason: 'patched-canary' };
106106
}
107107
return { vulnerable: true, reason: '16.x-canary' };

‎lib/vulnerabilities/cve-2025-55184.js‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
* - Next.js 15.5.x before 15.5.8
1414
* - Next.js 15.x canary before 15.6.0-canary.59
1515
* - Next.js 16.0.x before 16.0.9
16-
* - Next.js 16.x canary before 16.1.0-canary.17
16+
* - Next.js 16.x canary before 16.1.0-canary.18
1717
* - React RSC packages 19.0.0 through 19.2.1
1818
*
1919
* Note: Next.js Pages Router applications are not affected.
@@ -42,7 +42,7 @@ const NEXT_PATCHED_VERSIONS = {
4242
// Patched canary versions (no 14.x canary patch available)
4343
const NEXT_CANARY_PATCHES = {
4444
15: '15.6.0-canary.59',
45-
16: '16.1.0-canary.17',
45+
16: '16.1.0-canary.18',
4646
};
4747

4848
// React RSC vulnerable versions (19.0.0 through 19.2.1)
@@ -127,7 +127,7 @@ function isNextVulnerable(version) {
127127
// Next.js 16.x
128128
if (major === 16) {
129129
if (isCanary) {
130-
if (compareVersions(raw, '16.1.0-canary.17') >= 0) {
130+
if (compareVersions(raw, '16.1.0-canary.18') >= 0) {
131131
return { vulnerable: false, reason: 'patched-canary' };
132132
}
133133
return { vulnerable: true, reason: '16.x-canary' };

‎test/cve-2025-55183.test.js‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -150,13 +150,13 @@ describe('CVE-2025-55183 (Source Code Exposure)', () => {
150150
assert.strictEqual(result.vulnerable, true);
151151
});
152152

153-
it('should flag 16.1.0-canary.16 as vulnerable', () => {
154-
const result = cve55183.isVulnerable('next', '16.1.0-canary.16');
153+
it('should flag 16.1.0-canary.17 as vulnerable', () => {
154+
const result = cve55183.isVulnerable('next', '16.1.0-canary.17');
155155
assert.strictEqual(result.vulnerable, true);
156156
});
157157

158-
it('should NOT flag 16.1.0-canary.17 as vulnerable (patched)', () => {
159-
const result = cve55183.isVulnerable('next', '16.1.0-canary.17');
158+
it('should NOT flag 16.1.0-canary.18 as vulnerable (patched)', () => {
159+
const result = cve55183.isVulnerable('next', '16.1.0-canary.18');
160160
assert.strictEqual(result.vulnerable, false);
161161
});
162162

@@ -280,9 +280,9 @@ describe('CVE-2025-55183 (Source Code Exposure)', () => {
280280
assert.strictEqual(result.recommended, '15.6.0-canary.59');
281281
});
282282

283-
it('should recommend 16.1.0-canary.17 for 16.x canaries', () => {
283+
it('should recommend 16.1.0-canary.18 for 16.x canaries', () => {
284284
const result = cve55183.getPatchedVersion('next', '16.1.0-canary.0');
285-
assert.strictEqual(result.recommended, '16.1.0-canary.17');
285+
assert.strictEqual(result.recommended, '16.1.0-canary.18');
286286
});
287287

288288
describe('React RSC patch recommendations', () => {

‎test/cve-2025-55184.test.js‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
* | Next.js 15.5.x | 15.5.8 |
2323
* | Next.js 15.x canary | 15.6.0-canary.59 |
2424
* | Next.js 16.0.x | 16.0.9 |
25-
* | Next.js 16.0.x canary| 16.1.0-canary.17 |
25+
* | Next.js 16.0.x canary| 16.1.0-canary.18 |
2626
*
2727
* Note: Pages Router applications are not affected.
2828
*/
@@ -206,18 +206,18 @@ describe('CVE-2025-55184 (Denial of Service)', () => {
206206
});
207207

208208
describe('Next.js 16.x canaries', () => {
209-
it('should flag 16.1.0-canary.12 as vulnerable (patch is .17)', () => {
209+
it('should flag 16.1.0-canary.12 as vulnerable (patch is .18)', () => {
210210
const result = cve55184.isVulnerable('next', '16.1.0-canary.12');
211211
assert.strictEqual(result.vulnerable, true);
212212
});
213213

214-
it('should flag 16.1.0-canary.16 as vulnerable', () => {
215-
const result = cve55184.isVulnerable('next', '16.1.0-canary.16');
214+
it('should flag 16.1.0-canary.17 as vulnerable', () => {
215+
const result = cve55184.isVulnerable('next', '16.1.0-canary.17');
216216
assert.strictEqual(result.vulnerable, true);
217217
});
218218

219-
it('should NOT flag 16.1.0-canary.17 as vulnerable (patched)', () => {
220-
const result = cve55184.isVulnerable('next', '16.1.0-canary.17');
219+
it('should NOT flag 16.1.0-canary.18 as vulnerable (patched)', () => {
220+
const result = cve55184.isVulnerable('next', '16.1.0-canary.18');
221221
assert.strictEqual(result.vulnerable, false);
222222
});
223223

@@ -341,9 +341,9 @@ describe('CVE-2025-55184 (Denial of Service)', () => {
341341
assert.strictEqual(result.recommended, '15.6.0-canary.59');
342342
});
343343

344-
it('should recommend 16.1.0-canary.17 for 16.x canaries', () => {
344+
it('should recommend 16.1.0-canary.18 for 16.x canaries', () => {
345345
const result = cve55184.getPatchedVersion('next', '16.1.0-canary.0');
346-
assert.strictEqual(result.recommended, '16.1.0-canary.17');
346+
assert.strictEqual(result.recommended, '16.1.0-canary.18');
347347
});
348348

349349
describe('React RSC patch recommendations', () => {

‎test/minimal-fixes.test.js‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -239,11 +239,11 @@ describe('computeMinimalFixes', () => {
239239
assert.strictEqual(fixes[0].fixes[0].patched, '15.6.0-canary.59');
240240
});
241241

242-
it('should select 16.1.0-canary.17 for 16.x canaries (covers all 3 CVEs)', () => {
242+
it('should select 16.1.0-canary.18 for 16.x canaries (covers all 3 CVEs)', () => {
243243
// 16.x canary patch versions:
244244
// - CVE-2025-66478: 16.1.0-canary.12
245-
// - CVE-2025-55184: 16.1.0-canary.17
246-
// - CVE-2025-55183: 16.1.0-canary.17
245+
// - CVE-2025-55184: 16.1.0-canary.18
246+
// - CVE-2025-55183: 16.1.0-canary.18
247247

248248
const analysisResults = [{
249249
path: '/test/package.json',
@@ -253,16 +253,16 @@ describe('computeMinimalFixes', () => {
253253
current: '16.1.0-canary.0',
254254
cves: [
255255
{ id: 'CVE-2025-66478', severity: 'critical', patchedVersion: '16.1.0-canary.12' },
256-
{ id: 'CVE-2025-55184', severity: 'high', patchedVersion: '16.1.0-canary.17' },
257-
{ id: 'CVE-2025-55183', severity: 'medium', patchedVersion: '16.1.0-canary.17' },
256+
{ id: 'CVE-2025-55184', severity: 'high', patchedVersion: '16.1.0-canary.18' },
257+
{ id: 'CVE-2025-55183', severity: 'medium', patchedVersion: '16.1.0-canary.18' },
258258
],
259259
inDeps: true,
260260
inDevDeps: false,
261261
}],
262262
}];
263263

264264
const fixes = computeMinimalFixes(analysisResults);
265-
assert.strictEqual(fixes[0].fixes[0].patched, '16.1.0-canary.17');
265+
assert.strictEqual(fixes[0].fixes[0].patched, '16.1.0-canary.18');
266266
});
267267
});
268268

@@ -596,14 +596,14 @@ describe('integration: getPatchedVersion across CVEs', () => {
596596
assert.strictEqual(patch55183?.recommended, '15.6.0-canary.59');
597597
});
598598

599-
it('should recommend 16.1.0-canary.17 for 16.x canaries', () => {
599+
it('should recommend 16.1.0-canary.18 for 16.x canaries', () => {
600600
const patch66478 = cve66478.getPatchedVersion('next', '16.1.0-canary.0');
601601
const patch55184 = cve55184.getPatchedVersion('next', '16.1.0-canary.0');
602602
const patch55183 = cve55183.getPatchedVersion('next', '16.1.0-canary.0');
603603

604604
assert.strictEqual(patch66478?.recommended, '16.1.0-canary.12');
605-
assert.strictEqual(patch55184?.recommended, '16.1.0-canary.17');
606-
assert.strictEqual(patch55183?.recommended, '16.1.0-canary.17');
605+
assert.strictEqual(patch55184?.recommended, '16.1.0-canary.18');
606+
assert.strictEqual(patch55183?.recommended, '16.1.0-canary.18');
607607
});
608608
});
609609
});

0 commit comments

Comments
 (0)