Resolve critical and high severity dependency vulnerabilities

[Copilot]

Security audit identified 2 severe vulnerabilities in npm dependencies: critical issues in Next.js 15.3.3 and high severity issues in tar package.

Changes

• Next.js 15.3.3 → 15.5.11 - Resolves 8 critical CVEs:

  • RCE in React flight protocol (GHSA-9qr9-h5gf-34mp)
  • SSRF via middleware redirect handling (GHSA-4342-x723-ch2f)
  • Server Actions source code exposure (GHSA-w37m-7fhw-fmv9)
  • Image optimization cache confusion (GHSA-g5qg-72qw-gw5v)
  • Content injection in image optimization (GHSA-xv57-4mr9-wg8v)
  • Multiple DoS vectors (GHSA-mwv6-3258-q52c, GHSA-9g9p-9gw9-jx7f, GHSA-h25m-26qc-wcjf)

• tar package - Resolves 3 high severity CVEs:

  • Arbitrary file overwrite via symlink poisoning (GHSA-8qq5-rm4j-mr97)
  • Race condition in path reservations (GHSA-r6q2-hw4h-h46w)
  • Hardlink path traversal (GHSA-34x7-hfp2-rc4v)

Remaining

One moderate severity issue (CVSS 5.9) in Next.js 15.5.11 requires upgrading to 16.x - deferred as breaking change. Documented in SECURITY_AUDIT.md.

Verification

cd app && npm audit

Expected: 0 critical, 0 high, 1 moderate

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• fonts.googleapis.com
  • Triggering command: /usr/local/bin/node /usr/local/bin/node /home/REDACTED/work/kushmanmb/kushmanmb/app/node_modules/next/dist/compiled/jest-worker/processChild.js -1949cf8c6b5b557ident_case lib/rustlib/x86_--edition=2015 -194�� 8a838b7947c2/out--error-format=json 8a838b7947c2/out--json=diagnostic-rendered-ansi,artifacts,future-incompat 8a838b7947c2/out--crate-type 8a838b7947c2/outgetopt .rcgu.o .rcgu.o .rcgu.o 8a83�� 8a838b7947c2/out-l 8a838b7947c2/outhelp,version,id,description,release,codename,all,short known-linux-gnu/-- 8a838b7947c2/outsh 8a838b7947c2/out-c -1949cf8c6b5b557node install/check.js || npm run build known-linux-gnu/metadata=881ade1650594551 (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

audit for error

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​next@​15.3.3 ⏵ 15.5.11		+74	+1	+47
	npm/​pkijs@​3.2.5 ⏵ 3.3.3			+2	-2
	npm/​asn1js@​3.0.6 ⏵ 3.0.7	+1		+1

View full report