fix(deps): patch critical Next.js RCE and Auth.js advisories

PO
2d ago
+109-110

Fixes: Critical Next.js RCE unpatched in production useSend web app

The web and marketing apps pinned a Next.js release with a known unauthenticated remote code execution that the public image optimizer exposes, together with critical Auth.js advisories. Automated security updates are disabled, so no fix pull request existed. Both apps now use patched releases and the vulnerable code no longer ships.

flowchart LR
  U["Internet client"] -->|"GET /_next/image"| O["Image optimizer (public in apps/web)"]
  O --> P["Next.js 15.5.18 image pipeline"]
  P -.->|"advisory: unauthenticated RCE"| R["Server code execution"]
  F["Fix: next 15.5.27, next-auth 4.24.15, adapter 2.11.3"] -->|"removes vulnerable code"| P
Detection evidence

Affected: int_13ee3c91c001c2c8xfdj06a9

Why this fix

The frozen lockfile that Railway deploys resolves the pinned Next.js release, and the advisory names 15.5.24 as the first fixed version; the web app enables the image optimizer, so that endpoint is public. Raising the pins to patched releases removes the vulnerable code from the built image. Exploitation by an arbitrary external client is not confirmed because remote image sources are restricted, and enabling Dependabot security updates remains a repository setting a maintainer must change.

flowchart LR
  U["Internet client"] -->|"GET /_next/image"| O["Image optimizer (public in apps/web)"]
  O --> P["Next.js 15.5.18 image pipeline"]
  P -.->|"advisory: unauthenticated RCE"| R["Server code execution"]
  F["Fix: next 15.5.27, next-auth 4.24.15, adapter 2.11.3"] -->|"removes vulnerable code"| P
Out of scope
  • The other open high and medium dependency advisories (57 high, 70 medium); this change covers the critical ones.
  • Enabling Dependabot security updates and secret scanning: repository settings a maintainer must change, not code.
Causal chain
  • Signal (alert): Critical Dependabot alerts: GHSA-2xp9-vwfh-vxw4 / GHSA-p293-qw3h-jr36 (next < 15.5.24) and GHSA-7rqj-j65f-68wh (next-auth < 4.24.15, @auth/core < 0.41.3)
  • Surfacing site: usesend/useSend at usesend/useSend:apps/web/package.json#dependencies
  • Mechanism: The deployed web app runs the pinned Next.js 15.5.18 and exposes the image optimization API publicly; the AVIF path is reachable without authentication, and the pinned next-auth/@auth/core releases carry the critical email-normalization advisory.
  • Producer: usesend/useSend application dependencies (next, next-auth, @auth/prisma-adapter), at usesend/useSend:apps/web/package.json#dependencies
  • Trigger: Dependabot alerts for the Next.js and Auth.js advisories first opened 2026-09-08 and no fix pull request exists because automated security updates are disabled.
  • Blast radius: unknown other resource(s), unknown other tenant(s); data at risk: none named
  • Producer evidence:
    • pnpm-lock.yaml resolves next@15.5.18, next-auth@4.24.14, @auth/core@0.41.2
    • nixpacks.toml / docker/Dockerfile deploy with pnpm i --frozen-lockfile
    • apps/web enables the image optimizer (next/image used, no images.unoptimized)
3 files changed (+109/-110)
  • apps/marketing/package.json: modified, +4/-4
  • apps/web/package.json: modified, +5/-5
  • pnpm-lock.yaml: modified, +100/-101

Repository lint: pnpm run lint (declared in package.json) fails over the whole repository (the declared target takes no file arguments), so the failure is not attributed to this change and did not block it; run it before merging.

Lint output 
field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides". See https://pnpm.io/settings for the new home of each setting.
@usesend/lib:lint: $ eslint . --max-warnings 0
usesend-js:lint: cache miss, executing 2b48c7c6e12d1991
usesend-js:lint: [WARN] The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides". See https://pnpm.io/settings for the new home of each setting.
usesend-js:lint: $ eslint . --max-warnings 0
usesend-js:lint: sh: 1: eslint: not found
usesend-js:lint: [ELIFECYCLE] Command failed.
@usesend/ui:lint: [ELIFECYCLE] Command failed.

 Tasks:    1 successful, 3 total
Cached:    0 cached, 3 total
  Time:    4.11s 
Failed:    usesend-js#lint

[ELIFECYCLE] Command failed with exit code 1.
[WARN] The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides". See https://pnpm.io/settings for the new home of each setting.
$ turbo lint

Attention:
Turborepo now collects completely anonymous telemetry regarding usage.
This information is used to shape the Turborepo roadmap and prioritize features.
You can learn more, including how to opt-out if you'd not like to participate in this anonymous program, by visiting the following URL:
https://turborepo.dev/docs/telemetry

• turbo 2.10.4
usesend-js#lint:  ERROR  command (/workspace/usesend/useSend/packages/sdk) /usr/local/bin/pnpm run lint exited (1)
 ERROR  run failed: command  exited (1)

View thread View autofix

Generated by Polylane. You can ask follow-ups by mentioning @polylane in a comment.

Summary by cubic

Patches critical Next.js and Auth.js advisories by raising dependency pins, so the vulnerable image optimizer and email-normalization code no longer ships.

  • The web and marketing apps move from next 15.5.18 to 15.5.27, with next-auth to 4.24.15 and @auth/prisma-adapter to 2.11.3; matching Next tooling (@next/mdx, eslint-config-next, @next/eslint-plugin-next) follows.
  • The web app's public image optimizer endpoint was reachable in the pinned releases (unauthenticated RCE); exploitation is not confirmed because remote image sources are restricted.
  • This change covers only the critical advisories; the 57 high and 70 medium advisories remain open, and enabling Dependabot security updates is a repository setting a maintainer must change.
  • Repo-wide lint fails before and after this change, so it is not attributed to this diff; run pnpm run lint before merging.