fix(deps): update dependency next to v15.5.16 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	15.5.14 → 15.5.16

---

Next.js has a Denial of Service with Server Components

GHSA-q4gf-8mx6-v5v3

More information

Details

A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this changelog.

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/vercel/next.js/security/advisories/GHSA-q4gf-8mx6-v5v3
• https://vercel.com/changelog/summary-of-cve-2026-23869
• https://github.com/advisories/GHSA-q4gf-8mx6-v5v3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

CVE-2026-44574 / GHSA-492v-c6pp-mqqv

More information

Details

Impact

Applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check.

Fix

We now only honor internal route-parameter normalization in trusted routing flows and ignore externally supplied parameter encodings that should never have been accepted from ordinary requests.

Workarounds

If you cannot upgrade immediately, enforce authorization in route or page logic instead of relying solely on middleware path matching.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv
• https://github.com/vercel/next.js/releases/tag/v15.5.16
• https://github.com/vercel/next.js/releases/tag/v16.2.5
• https://github.com/advisories/GHSA-492v-c6pp-mqqv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vercel/next.js (next)

v15.5.16

Compare Source

v15.5.15

Compare Source

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sandbox-voice-assistant	Ready	Preview	May 12, 2026 4:53am