UI5 / webcomponents-react / 30257485449

86%

main: 86%

push

github

chore(deps): update dependency next to v16.2.11 [security] (#8822)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [next](https://nextjs.org)
([source](https://redirect.github.com/vercel/next.js)) | [`16.2.10` →
`16.2.11`](https://renovatebot.com/diffs/npm/next/16.2.10/16.2.11) |
![age](https://developer.mend.io/api/mc/badges/age/npm/next/16.2.11?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/next/16.2.10/16.2.11?slim=true)
|

---

### Next.js: Denial of Service in App Router using Server Actions
[CVE-2026-64641](https://nvd.nist.gov/vuln/detail/CVE-2026-64641) /
[GHSA-m99w-x7hq-7vfj](https://redirect.github.com/advisories/GHSA-m99w-x7hq-7vfj)

<details>
<summary>More information</summary>

#### Details
##### Impact

Crafted requests targeting Next.js applications using App Router with at
least one Server Action can lead to excessive CPU usage blocking
processing of further requests in the same process.

##### Workarounds

No workaround exists besides upgrading. Applications using Pages Router
or not using Server Actions are not vulnerable.

#### Severity
- CVSS Score: 8.2 / 10 (High)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`

#### References
-
[https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj)
-
[https://github.com/vercel/next.js/pull/96013](https://redirect.github.com/vercel/next.js/pull/96013)
-
[https://github.com/vercel/next.js/commit/<a class=hub.com/UI5/webcomponents-react/commit/019628571641dec57aaf349ba0c360e3964e6f12">019628571](https://redirect.github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12)
-
[https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)
-
[https://github.com/ve... (continued)

4116 of 5185 branches covered (79.38%)

Branch coverage included in aggregate %.

7054 of 7879 relevant lines covered (89.53%)

318395.11 hits per line