🚨 [security] Update next 15.3.2 → 15.3.6 (patch)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ next (15.3.2 → 15.3.6) · Repo

Security Advisories 🚨

🚨 Next.js is vulnerable to RCE in React flight protocol

A vulnerability affects certain React packages¹ for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55182.

Fixed in:
React: 19.0.1, 19.1.2, 19.2.1
Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7

The vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76.

All users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately.

¹ The affected React packages are:

• react-server-dom-parcel
• react-server-dom-turbopack
• react-server-dom-webpack

🚨 Next.js has a Cache poisoning vulnerability due to omission of the Vary header

Summary

A cache poisoning issue in Next.js App Router >=15.3.0 and < 15.3.3 may have allowed RSC payloads to be cached and served in place of HTML, under specific conditions involving middleware and redirects. This issue has been fixed in Next.js 15.3.3.

Users on affected versions should upgrade immediately and redeploy to ensure proper caching behavior.

More details: CVE-2025-49005

Release Notes

15.3.6

Please see CVE-2025-66478 for additional details about this release.

15.3.5

Note

This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Turbopack: list assert/strict as external (#80884)
• omit searchParam data from FlightRouterState before transport (#80734)
• bugfix: propagate staleTime to seeded prefetch entry (#81263)

Misc Changes

• document turbopack trace viewer (#78184)

Credits

Huge thanks to @ztanner, @mischnic, and @bgw for helping!

15.3.4

Note

This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [metadata] render streaming metadata on the top level (#80566)
• [fix] clone the config module to avoid mutation (#80573)

Credits

Huge thanks to @huozhi for helping!

15.3.3

Note

This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Reinstate vary (#79939)
• fix(next-swc): Fix interestingness detection for React Compiler (#79558)
• fix(next-swc): Fix react compiler usefulness detector (#79480)
• fix(dev-overlay): Better handle edge-case file paths in launchEditor (#79526)
• Client router should discard stale prefetch entries for static pages (#79362)

Credits

Huge thanks to @gaojude, @kdy1, @bgw, and @unstubbable for helping!

Does any of this look wrong? Please let us know.

Sorry, we couldn't find anything useful about this release.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
aulianza-id	Ready	Preview	Comment	Dec 3, 2025 8:08pm

[depfu]

Closed in favor of #475.