[Aikido] Fix 68 security issues in axios, form-data, next

[aikido-autofix]

Upgrade axios, form-data, and next to fix critical SSRF, prototype pollution, and proxy bypass vulnerabilities.

✅ Code not affected by breaking changes.

✅ No breaking changes from either the axios or Next.js upgrades affect this codebase.

Axios (1.7.8 => 1.16.0):

• The codebase uses axios only with absolute URLs (no baseURL configuration combined with request URLs), so the allowAbsoluteUrls breaking change does not apply.

Next.js (14.2.10 => 15.5.21):

• The Next.js example app (examples/example-web-nextjs) already uses export const dynamic = "force-dynamic" in route handlers, so the breaking change about disabling automatic static generation does not affect it.

• The next/image component usage has no leading/trailing spaces in the src attribute.

• The codebase already requires Node.js >=18, meeting the new minimum version requirement of 18.18.

• No usage of deprecated APIs like geo, ip, useMDXComponents, unstable_rootParams, forwardRef in Link, or any other deprecated features mentioned in the changelog.

• No synchronous usage of cookies(), headers(), params, or searchParams that would require async migration.

• No usage of "use server", "use cache", or other experimental features that have new restrictions.

• The ESLint configuration uses version 8, which is compatible (Next.js 15 supports ESLint v9, but v8 continues to work).

All breaking changes by upgrading axios from version 1.7.8 to 1.18.1 (CHANGELOG)

Version	Description
1.8.0	Code relying on absolute URL handling will now combine the URLs instead of preferring the request URL due to the new allowAbsoluteUrls config option
1.15.0	Headers containing \r or \n characters are now rejected and throw "Invalid character in header content" to block CRLF injection
1.16.0	Fetch adapter now enforces maxBodyLength and maxContentLength limits which were previously silently ignored
1.16.0	parseProtocol now strictly requires a colon in the protocol separator; strings that loosely parsed as protocols before may no longer match
1.18.0	Malformed http: and https: URLs that omit // are now rejected with ERR_INVALID_URL

All breaking changes by upgrading next from version 14.2.10 to 15.5.21 (CHANGELOG)

Version	Description
15.0.0	Remove deprecated analyticsId from config, and the corresponding performance-relayer files and tests
15.0.0	Remove squoosh in favor of sharp as optional dependency for next/image
15.0.0	Change default Content-Disposition to attachment for next/image
15.0.0	Error when src has leading or trailing space in next/image
15.0.0	Set upstream timeout to 7 seconds for next/image
15.0.0	Add sharp timeout of 10 seconds
15.0.0	Pages router: Enable strict next/head children reconciler by default
15.0.0	Disable automatic static generation for route handlers
15.0.0	Disable client router cache for page segments
15.0.0	Disable automatic fetch caching
15.0.0	Remove geo and ip from NextRequest
15.0.0	Update Dynamic APIs to be async (cookies, headers, params, searchParams)
15.0.0	Support ESLint v9 in plugin, config and next lint
15.0.0	Bump minimum Node.js version to 18.18 (up from 18.17)
15.1.0	Error on navigation API usage in pages router and middleware: navigation API usage is now forbidden in pages router and middleware, which will cause errors for code that previously used these APIs in those contexts.
15.1.0	Disallow multiple server directives at the same level (file or function): code with multiple server directives (like "use server" and "use cache") at the same level will no longer be allowed.
15.1.0	Forbid this and arguments in server functions: server functions can no longer use this or arguments, which will break existing server functions that rely on these features.
15.1.0	Forbid super in static class methods with server function directives: static class methods with server function directives cannot use super, breaking code that previously did so.
15.1.0	Emit build error when "use cache" is used without dynamicIO enabled: builds will now fail if "use cache" is used without enabling the dynamicIO flag.
15.1.0	Emit build error for unknown cache kinds: builds will fail when encountering unknown cache kinds, which may break builds that previously succeeded with warnings or were silently ignored.
15.1.0	Increase max cache tags to 128: while this is an increase, it establishes a new hard limit that could break code attempting to use more than 128 cache tags.
15.2.0	Removed internal_disableSyncDynamicAPIWarnings flag
15.2.0	Disabled colormin feature from cssnano
15.2.0	Turbopack now uses new backend by default
15.2.0	Removed experimental.reactOwnerStack flag
15.2.0	rootParams() is now a plain Promise (not exotic)
15.2.0	Removed --no-mangling CLI option for next build
15.2.0	Deprecated devIndicators options appIsrStatus and buildActivity
15.2.0	Deprecated devIndicators.buildActivityPosition and renamed to position
15.2.0	Removed old Dev Overlay
15.2.0	Removed the experiment config for overlay (new dev overlay enabled by default)
15.2.0	Streaming metadata enabled by default
15.2.0	Promoted streaming metadata configs to stable
15.2.0	Warning about i18n configuration deprecation in app router
15.2.0	Disabled turbo daemon by default
15.2.0	Error when output: export is used with intercepting routes
15.2.0	Emit build error when useCache is enabled and Edge runtime is used
15.2.0	Disallowed rootParams() in cache scope
15.3.0	Development origin verification switched to be opt-in rather than opt-out
15.3.0	Direct IP/port bypass removed in dev origin check
15.3.0	forwardRef removed from Link in App Router
15.3.0	Deprecation warning added for legacyBehavior prop
15.3.0	Turbopack build now requires --turbopack flag with next start, otherwise throws error
15.3.0	Output server.mjs for standalone with type: module
15.5.0	useMDXComponents argument removed
15.5.0	experimental.strictNextHead removed
15.5.0	Disallow sync access of cookies & headers at runtime in Cache Components
15.5.0	experimental.dynamicIO renamed to experimental.cacheComponents
15.5.0	unstable_rootParams deprecated with warning
15.5.0	AMP deprecated with warning

✅ 68 CVEs resolved by this upgrade, including 6 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-42043	🚨 CRITICAL	[axios] An attacker who can influence the target URL can bypass NO_PROXY protection by using any address in the 127.0.0.0/8 range (except 127.0.0.1), allowing requests to reach unintended destinations. This enables potential information disclosure or unauthorized access to local services.
CVE-2025-62718	🚨 CRITICAL	[axios] Improper hostname normalization in NO_PROXY rule checking allows requests to loopback addresses (localhost., [::1]) to bypass proxy protections, enabling proxy bypass and potential SSRF attacks against internal services. This vulnerability permits attackers to reach sensitive services despite configured NO_PROXY protections.
CVE-2026-42264	🚨 CRITICAL	[axios] Prototype pollution vulnerability in HTTP adapter allows attackers to exploit five config properties (auth, baseURL, socketPath, beforeRedirect, insecureHTTPParser) without hasOwnProperty guards, enabling RCE or request manipulation when Object.prototype is polluted by other dependencies.
CVE-2026-42044	🚨 CRITICAL	[axios] Prototype Pollution vulnerability allows attackers to manipulate JSON API responses through a polluted parseReviver function, enabling privilege escalation, balance manipulation, and authorization bypass. The default transformResponse function unsafely calls JSON.parse with an unvalidated parseReviver parameter from the config object.
CVE-2026-44494	HIGH	[axios] Prototype pollution vulnerability allows escalation to Man-in-the-Middle attacks by injecting a malicious proxy into the prototype chain, enabling interception and modification of all HTTP traffic including authentication credentials. An attacker can read and alter all application HTTP communications through a compromised dependency.
CVE-2026-44490	HIGH	[axios] Axios contains prototype pollution gadgets that allow upstream dependencies to inject malicious values into HTTP headers or cause synchronous TypeErrors on every request. This enables information disclosure or denial of service attacks when Object.prototype is polluted by other libraries.
CVE-2026-40175	HIGH	[axios] A prototype pollution vulnerability in a third-party dependency can be exploited to inject unsanitized header values into outbound HTTP requests. This allows attackers to manipulate request headers, potentially leading to request smuggling, cache poisoning, or other header-based attacks.
CVE-2025-58754	HIGH	[axios] A vulnerability allows attackers to supply large data: scheme URLs that bypass memory limits, causing unbounded memory allocation and process crashes (DoS) on Node.js. The issue affects versions 0.28.0 through 0.30.1 and 1.x before 1.12.0.
CVE-2026-25639	HIGH	[axios] The mergeConfig function crashes with a TypeError when processing configuration objects containing proto as an own property, allowing attackers to trigger denial of service. An attacker can exploit this by providing a malicious configuration object created via JSON.parse().
CVE-2026-42038	HIGH	[axios] Incomplete hostname normalization in no_proxy bypass allows requests to IP loopback addresses (127.0.0.1, [::1]) to route through proxy when no_proxy=localhost is set, enabling proxy bypass circumvention. This occurs due to pure string matching without IP alias resolution.
CVE-2026-42039	HIGH	[axios] A deeply nested object passed as request data causes the toFormData function to recursively walk without depth limits, crashing the Node.js process with a RangeError (Denial of Service). This vulnerability allows attackers to trigger application crashes through maliciously crafted nested payloads.
CVE-2026-44486	HIGH	[axios] Axios' Node.js HTTP adapter leaks proxy credentials to redirect targets when following redirects through authenticated proxies, allowing the Proxy-Authorization header to persist on redirected requests. This information disclosure vulnerability affects Node.js environments with automatic redirects and authenticated proxy configurations enabled.
CVE-2026-44487	HIGH	[axios] Axios's Node.js HTTP adapter may leak Proxy-Authorization credentials to redirected origins when following redirects from proxied to direct connections, allowing credential disclosure. This occurs when an authenticated proxy request redirects to a non-proxied URL, potentially exposing proxy credentials to the final destination.
CVE-2026-44488	HIGH	[axios] The fetch adapter fails to enforce configured request and response size limits (maxContentLength, maxBodyLength), allowing oversized bodies to be processed and causing potential resource exhaustion or denial of service attacks.
CVE-2026-42033	HIGH	[axios] A prototype pollution vulnerability allows attackers to intercept and modify JSON responses or hijack HTTP transport to access credentials and headers. This requires prior prototype pollution from a co-dependency but enables complete request/response manipulation.
CVE-2026-42035	HIGH	[axios] A prototype pollution gadget in the HTTP adapter allows attackers to inject arbitrary HTTP headers into outgoing requests by polluting Object.prototype with specific properties. This enables header injection attacks that could lead to request manipulation and potential security bypasses.
CVE-2026-44495	HIGH	[axios] Contains prototype-pollution gadgets in request config processing that could be exploited if Object.prototype is already polluted by another vulnerability, potentially allowing arbitrary code execution or request manipulation. Requires a separate prototype-pollution vulnerability or prior attacker control over Object.prototype to be exploitable.
CVE-2026-42041	MEDIUM	[axios] A Prototype Pollution vulnerability allows attackers to suppress HTTP error responses by polluting Object.prototype.validateStatus, causing all status codes to be treated as successful and bypassing authentication and error handling.
CVE-2025-27152	MEDIUM	[axios] Axios sends requests to absolute URLs even when baseURL is configured, bypassing intended routing and potentially causing Server-Side Request Forgery (SSRF) and credential leakage in both server and client environments.
CVE-2026-42042	MEDIUM	[axios] Uses truthy/falsy semantics instead of strict boolean comparison for XSRF token protection, allowing attackers to bypass same-origin checks via prototype pollution or misconfiguration and steal XSRF tokens sent to cross-origin servers. This enables CSRF attacks against protected endpoints.
CVE-2026-42034	MEDIUM	[axios] A vulnerability allows attackers to bypass the maxBodyLength restriction on stream request bodies when maxRedirects is set to 0, enabling oversized uploads to be sent despite strict body limits. This could lead to denial of service or resource exhaustion attacks.
CVE-2026-42036	MEDIUM	[axios] When responseType is set to 'stream', the library fails to enforce maxContentLength limits, allowing attackers to bypass response-size restrictions and cause denial of service through unbounded data consumption.
CVE-2026-42037	MEDIUM	[axios] Unsanitized CRLF sequences in the Content-Type header of multipart form-data parts allow header injection attacks when processing user-controlled Blob/File objects. An attacker can inject arbitrary MIME headers into the multipart body, bypassing Node.js v18+ header protections.
CVE-2026-42040	LOW	[axios] A character mapping in the encode() function incorrectly reverses percent-encoding of null bytes, converting %00 back to raw null bytes and potentially enabling injection attacks in certain contexts. The vulnerability has limited impact as standard axios request flows are unaffected.
CVE-2025-7783	🚨 CRITICAL	[form-data] Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.
CVE-2026-12143	HIGH	[form-data] A CRLF injection vulnerability in the field and filename arguments allows attackers to inject headers or multipart parts into requests, potentially enabling form field manipulation or bypass attacks when untrusted input is used as field names or filenames.
CVE-2025-29927	🚨 CRITICAL	[next] A vulnerability allows attackers to bypass authorization checks in middleware by manipulating the x-middleware-subrequest header, potentially gaining unauthorized access to protected resources. The impact is authorization bypass, which could lead to unauthorized data access or actions depending on the application's implementation.
CVE-2026-44578	HIGH	[next] Self-hosted applications are vulnerable to server-side request forgery (SSRF) through crafted WebSocket upgrade requests, allowing attackers to proxy requests to arbitrary destinations and potentially expose internal services or cloud metadata. Vercel-hosted deployments are unaffected.
AIKIDO-2026-10758	HIGH	[next] A WebSocket upgrade proxying vulnerability allows attackers to craft requests that trigger outbound connections to arbitrary destinations, enabling server-side request forgery and potential exposure of internal services. This affects self-hosted deployments and can be exploited to reach internal or external targets.
AIKIDO-2026-573829	HIGH	[next] Dynamic hostname resolution in rewrites/redirects rules allows untrusted request values to redirect to arbitrary hosts, enabling Server-Side Request Forgery via rewrites or open redirects via redirects rules.
AIKIDO-2026-283297	HIGH	[next] Server Actions can be exploited to perform Server-Side Request Forgery (SSRF) attacks by manipulating untrusted Host headers to redirect requests to malicious hosts, potentially disclosing internal values and bypassing authorization. The vulnerability affects deployments without host-pinning proxies where incoming headers are not validated.
CVE-2025-57822	HIGH	[next] A vulnerability in the next() middleware function could lead to Server-Side Request Forgery (SSRF) in self-hosted applications when the request object was not explicitly passed, allowing attackers to manipulate forwarded headers. This affects custom middleware implementations that incorrectly forward user-supplied headers.
AIKIDO-2026-284523	HIGH	[next] A vulnerability in App Router Server Actions allows unauthenticated attackers to cause denial of service by sending crafted requests that trigger excessive iteration, consuming CPU resources and blocking the event loop from processing further requests.
CVE-2024-51479	HIGH	[next] Authorization bypass vulnerability in middleware pathname-based checks allows attackers to access protected pages directly under the application root directory. This could lead to unauthorized access to sensitive functionality or data.
GHSA-q4gf-8mx6-v5v3	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
AIKIDO-2026-10762	HIGH	[next] A deserialization vulnerability in server function endpoints allows attackers to consume excessive CPU through crafted input, causing denial of service by exhausting request handling capacity and degrading application availability.
AIKIDO-2026-10757	HIGH	[next] A vulnerability in Pages Router with i18n allows attackers to bypass middleware authorization checks by accessing locale-less data routes, enabling unauthorized access to protected page data through alternate paths.
CVE-2026-44573	HIGH	[next] A vulnerability allows unauthorized access to protected page data in applications using Pages Router with i18n configuration, as middleware authorization checks are bypassed for locale-less data route requests. An attacker can retrieve sensitive SSR JSON data without passing authorization checks, resulting in information disclosure.
GHSA-8h8q-6873-q5fj	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
CVE-2026-64641	HIGH	[next] Crafted requests targeting Next.js applications with App Router and Server Actions can cause excessive CPU usage, leading to denial of service by blocking request processing. This vulnerability allows attackers to exhaust server resources and prevent legitimate requests from being handled.
CVE-2026-29057	MEDIUM	[next] HTTP request smuggling vulnerability in Next.js rewrites with chunked DELETE/OPTIONS requests allows attackers to bypass route restrictions and access unintended backend endpoints. An attacker could smuggle malicious requests to internal or admin routes through request boundary disagreement between proxy and backend.
CVE-2026-64649	MEDIUM	[next] Server Actions can be exploited to perform Server-Side Request Forgery (SSRF) attacks when Host headers are not properly validated, allowing attackers to redirect requests to malicious hosts or access internal values. This affects applications on custom servers or deployments without upstream host pinning.
AIKIDO-2026-467347	MEDIUM	[next] Server-side fetch cache keys are derived from lossy text decoding of request bodies, allowing distinct requests with different bodies to share cache entries and leak confidential data between callers. The vulnerability affects the App Router and is fixed by keying the cache on raw body bytes instead.
AIKIDO-2026-339670	MEDIUM	[next] Server Action and cache endpoint identifiers are exposed in publicly served client artifacts, allowing unauthenticated users to enumerate internal endpoints and potentially exploit weak authorization controls.
AIKIDO-2026-165691	MEDIUM	[next] Server Actions on Edge runtime lack request body size limits, allowing unauthenticated attackers to send oversized requests that exhaust memory and cause denial of service.
CVE-2025-57752	MEDIUM	[next] Cache key confusion in Image Optimization API routes allows unauthorized users to access cached images intended for other users when responses vary based on request headers like cookies or authorization tokens. This enables information disclosure and potential unauthorized access to sensitive image content.
AIKIDO-2026-10755	MEDIUM	[next] Inline beforeInteractive script serialization insufficiently escapes untrusted input, allowing attackers to break script boundaries and execute arbitrary JavaScript in the browser when untrusted data is passed to script props.
CVE-2026-44580	MEDIUM	[next] A cross-site scripting (XSS) vulnerability exists in applications using beforeInteractive scripts with untrusted content, where serialized script content is not properly escaped, allowing attackers to execute arbitrary JavaScript in visitors' browsers.
CVE-2026-64645	MEDIUM	[next] A vulnerability in rewrites() and redirects() rules allows attackers to manipulate request-controlled input to point to arbitrary hostnames, enabling Server-Side Request Forgery (SSRF) via rewrites or Open Redirect attacks via redirects().
AIKIDO-2026-206850	MEDIUM	[next] A cache key vulnerability in server-side fetch responses fails to account for request body differences, allowing unauthorized users to receive cached responses containing confidential data from other requests. This information disclosure vulnerability affects applications using the App Router.
AIKIDO-2026-10754	MEDIUM	[next] The Image Optimization API fails to enforce consistent maximum-size limits when loading local images into memory, allowing attackers to exhaust process memory through large local assets and cause denial of service in self-hosted configurations.
CVE-2026-44577	MEDIUM	[next] A memory exhaustion vulnerability in the Image Optimization API allows attackers to trigger out-of-memory conditions by requesting large local assets through the /_next/image endpoint without size limits. This can cause denial of service by consuming excessive server memory.
CVE-2026-44572	MEDIUM	[next] A vulnerability allows attackers to send a crafted x-nextjs-data header on requests to middleware-handled paths, causing the redirect response to use an internal header instead of the standard Location header, which browsers cannot follow. If deployed behind a caching CDN or reverse proxy, this can poison the cache and cause denial of service for affected redirect paths.
AIKIDO-2026-10753	MEDIUM	[next] A cache poisoning vulnerability allows attackers to cause incorrect React Server Component payloads to be cached and served to users under shared-cache conditions, potentially returning malformed responses and compromising application functionality.
CVE-2026-44576	MEDIUM	[next] Applications using React Server Components are vulnerable to cache poisoning due to improper response variant partitioning in shared caches, allowing attackers to serve component payloads instead of HTML and poison cache entries for subsequent visitors. This enables unauthorized content injection and potential remote code execution through malicious component payloads.
CVE-2026-64647	MEDIUM	[next] A server-side fetch caching vulnerability allows responses from POST requests with non-UTF-8 charset bodies to be incorrectly returned to different requests, potentially leaking confidential data. This affects requests to the same URL with different request bodies that produce identical cache keys due to charset encoding differences.
CVE-2026-64648	MEDIUM	[next] Server-side fetch requests with different body parameters may return cached responses from other requests to the same URL, causing confidential data leakage to unauthorized callers. This information disclosure vulnerability affects fetch calls where the request object and init parameters differ.
CVE-2024-56332	MEDIUM	[next] Next.js Server Actions are vulnerable to Denial of Service attacks where crafted requests cause Server Action invocations to hang indefinitely, consuming function execution time and potentially causing excessive billing charges on serverless platforms.
CVE-2026-64643	MEDIUM	[next] Next.js applications using App Router and Server Actions can leak Server Action IDs to unauthenticated users through publicly served client artifacts, enabling reconnaissance that may facilitate attacks when combined with other vulnerabilities. This information disclosure bypasses authentication controls on affected endpoints.
CVE-2026-64646	MEDIUM	[next] A vulnerability in Next.js App Router with Server Actions using Edge runtime allows attackers to cause excessive memory consumption through specially crafted requests, leading to potential denial of service. This memory exhaustion attack can crash or severely degrade application performance.
AIKIDO-2026-10756	MEDIUM	[next] A vulnerability in App Router allows malformed CSP nonce values from request headers to be reflected into HTML, potentially poisoning cached content and enabling script execution for other users in shared-cache deployments.
CVE-2026-44581	MEDIUM	[next] App Router applications using CSP nonces are vulnerable to stored cross-site scripting when deployed behind shared caches, as malformed nonce values from request headers can be unsafely reflected into HTML, allowing attackers to poison cached responses and execute scripts for subsequent visitors.
CVE-2025-55173	MEDIUM	[next] Next.js Image Optimization is vulnerable to content injection that allows attackers to trigger arbitrary file downloads with malicious content and filenames through external image sources. This could enable phishing attacks or malicious file delivery under specific configurations.
CVE-2025-48068	MEDIUM	[next] A vulnerability in the dev server with App Router enabled could expose limited source code to attackers who trick users into visiting malicious webpages during local development. This information disclosure vulnerability only affects development environments and has been patched in recent versions.
CVE-2025-32421	LOW	[next] A race-condition vulnerability in the Pages Router causes normal endpoints to serve pageProps data instead of HTML under certain misconfigurations, potentially leading to information disclosure. This affects self-hosted deployments where responses may be cached without explicit cache-control headers.
AIKIDO-2026-10752	LOW	[next] RSC cache-busting values can collide in shared cache deployments, allowing attackers to poison cache variants and serve incorrect component responses to users. This vulnerability stems from insufficient collision resistance in response variant separation.
AIKIDO-2026-10751	LOW	[next] A vulnerability in middleware redirect handling allows attackers to manipulate redirect responses and poison caches by spoofing internal-data headers, causing subsequent users to receive broken cached redirects until expiry.
CVE-2026-44582	LOW	[next] React Server Component responses are vulnerable to cache poisoning due to insufficient response partitioning, allowing attackers to manipulate cache entries and serve incorrect content to users. This can lead to information disclosure or content manipulation through collisions in cache-busting values.

🤖 Remediation details

Fix critical/high/medium security vulnerabilities in next, axios, and form-data

Short summary

This PR remediates known vulnerabilities in three packages — next, axios, and form-data — declared or resolved in examples/example-web-nextjs/package.json and its yarn.lock. The direct dependency next was bumped in the manifest; axios and form-data are transitive dependencies whose stale lockfile entries were refreshed. A resolutions override was also added to address a new sharp vulnerability introduced as a side-effect of the next upgrade, because no stable next release in the 15.x line can resolve sharp to a patched version without a semver-major override.

next

next is a direct dependency pinned exactly at 14.2.10 in examples/example-web-nextjs/package.json. The manifest was updated to 15.5.21 — the minimum stable release that satisfies all patched-version requirements across the full set of next advisories in scope — and yarn install refreshed the lockfile entry. eslint-config-next was bumped in lockstep from 13.4.13 to 15.5.21 to preserve the project's existing practice of keeping these two related packages on matching versions.

axios

axios is a transitive dependency pulled in by langfuse-node under the spec ^1.7.4. The lockfile entry was stale at 1.7.8; because the declared range already admits 1.16.0 and above, no manifest change was required — running yarn upgrade 'axios@^1.7.4' was sufficient to refresh the lockfile entry to 1.18.1, satisfying the >=1.16.0 patched-version floor required by the highest-severity advisories in scope. yarn upgrade transiently added axios as a direct dependency in package.json, which was immediately removed since it was and remains transitive-only.

form-data

form-data is a transitive dependency of axios, declared by axios as ^4.0.0 (later ^4.0.5 after the axios upgrade). The lockfile entry was stale at 4.0.0; it was resolved to 4.0.6 automatically when axios was upgraded, satisfying the >=4.0.6 patched-version floor. No separate manifest or lockfile action was needed beyond the axios refresh.

sharp

sharp was not present in the lockfile before this PR. Upgrading next from 14.2.10 to 15.5.21 introduced sharp as a new optional transitive dependency via next's optionalDependencies: "^0.34.3", which resolved to the vulnerable 0.34.5 (GHSA-f88m-g3jw-g9cj, fixed in 0.35.0). Every published next release in the 15.x line declares sharp@^0.34.3, making 0.35.0 unreachable through a parent bump because it is a semver-major step; the only next releases that declare ^0.35.x are unstable 16.x canary/preview builds. A targeted resolutions: { "sharp": "^0.35.0" } entry was added to examples/example-web-nextjs/package.json as a last resort, resolving the lockfile entry to 0.35.3.

Version changes

Package	From	To	Why updated
next	14.2.10	15.5.21	Direct CVE fix
eslint-config-next	13.4.13	15.5.21	Related package alignment with next
axios	1.7.8	1.18.1	Transitive CVE fix; lockfile refresh of stale ^1.7.4 entry (parent: langfuse-node)
form-data	4.0.0	4.0.6	Transitive CVE fix; pulled in automatically by axios upgrade
sharp	(not present) → 0.34.5	0.35.3	New transitive introduced by next upgrade; patched via resolutions override (semver-major barrier in next@15.x)

---

Note

Medium Risk
Next 14→15 is a major upgrade with many framework breaking changes; risk is moderated because this is an example app with minimal app code, but builds and runtime behavior should still be verified.

Overview
Security-driven dependency refresh for examples/example-web-nextjs: direct next moves from 14.2.10 → 15.5.21 and eslint-config-next from 13.4.13 → 15.5.21 so the sample app tracks a patched framework and matching ESLint preset.

A new resolutions entry forces sharp ^0.35.0 because Next 15 pulls in image tooling that would otherwise stay on a vulnerable 0.34.x line that cannot be fixed by bumping next alone within 15.x.

yarn.lock is regenerated: transitive axios (via langfuse-node) and form-data (via axios) land on patched versions, and the lockfile picks up Next 15’s toolchain (e.g. @typescript-eslint 8.x, updated eslint plugins, optional sharp platform packages).

^{Reviewed by Cursor Bugbot for commit e3f4916. Bugbot is set up for automated code reviews on this repo. Configure here.}