[Snyk] Security upgrade next from 13.0.6 to 16.1.7

[karencapiiro]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• website/package.json
• website/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	HTTP Request Smuggling SNYK-JS-NEXT-15674558	104
	Allocation of Resources Without Limits or Throttling SNYK-JS-NEXT-15674556	66

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[karencapiiro]

This is a major upgrade spanning three major versions (v14, v15, v16) and introduces significant breaking changes that will require substantial code and configuration updates. A direct upgrade is not recommended; a phased migration (13 → 14 → 15 → 16) using the provided codemods at each step is essential.

Key Breaking Changes & Required Actions:

From v13 → v14:

• Node.js Version: The minimum required Node.js version was raised to 18.17.
• Static Exports: The next export command has been removed. You must migrate to the output: 'export' configuration in next.config.js.
• Font and Image Imports: The @next/font package is removed in favor of the built-in next/font, and the ImageResponse import has moved from next/server to next/og. Codemods are available for these changes.

From v14 → v15:

• Asynchronous Request APIs: This is a critical change. APIs like cookies(), headers(), and params are now asynchronous and must be awaited (await cookies()). This change improves performance but requires code modification throughout your app. A codemod is available to help automate this.
• Caching Behavior: Caching is now opt-in. Previously, fetch requests, GET Route Handlers, and client navigations were cached by default. In v15+, they are uncached by default. This fundamental shift requires a review of your data fetching strategy to opt into caching where needed.
• React 19 Required: Next.js 15 requires React 19, which introduces its own breaking changes, such as replacing the useFormState hook with useActionState.

From v15 → v16:

• Node.js Version: The minimum Node.js version is now 20.9. Support for Node 18 is dropped.
• Turbopack is Default: Turbopack is now the default bundler, replacing Webpack. If you have a custom Webpack configuration (webpack: in next.config.js), your build will fail. You must either migrate your configuration to be Turbopack-compatible or explicitly opt-out by using the --webpack flag.
• Middleware Renamed: The middleware.ts file must be renamed to proxy.ts. A codemod can automate this.
• AMP Support Removed: All support and configuration for AMP have been completely removed.

Recommendation:
This upgrade is a significant undertaking. Do not attempt a direct jump from v13 to v16. Plan a staged migration, upgrading one major version at a time. At each stage, run the official Next.js codemods (npx @next/codemod@canary upgrade latest) to automate as many changes as possible and thoroughly test your application before proceeding to the next version.

Source: Next.js Upgrade Guides

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​next@​13.0.6 ⏵ 16.1.7	-1	+74	-3

View full report

[jit-ci]

🛡️ Jit Security Scan Results

✅ No security findings were detected in this PR

---

^{Security scan by Jit}

[karencapiiro]

Checkmarx One – Scan Summary & Details – ff8ae585-a7c1-4271-8c44-b691aa23fe89

---

New Issues (14)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2025-14874	Npm-nodemailer-6.8.0	details Recommended version: 7.0.11 Description: A flaw was found in Nodemailer versions through 7.0.10. This vulnerability allows a Denial-of-Service (DoS) via a crafted email address header that... Attack Vector: NETWORK Attack Complexity: LOW ID: xi0XTRMAtlytELhVt%2BY4rYmUs4YYzsVpGEOlxqta45I%3D Vulnerable Package
2		CVE-2025-66418	Python-urllib3-1.26.20	details Recommended version: 2.6.3 Description: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression ch... Attack Vector: NETWORK Attack Complexity: LOW ID: N0doRvUgN39Gta90UKSzZPW491bd7Z0MFtODLhZxZdU%3D Vulnerable Package
3		CVE-2026-21441	Python-urllib3-1.26.20	details Recommended version: 2.6.3 Description: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the... Attack Vector: NETWORK Attack Complexity: LOW ID: UPtiYb7PrlZaMcbei%2FqzqObRVB96d%2Bnl60luqJjJzWg%3D Vulnerable Package
4		CVE-2026-25639	Npm-axios-1.2.1	details Recommended version: 1.13.5 Description: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.13.5, the mergeConfig function in axios crashes with a TypeError when ... Attack Vector: NETWORK Attack Complexity: LOW ID: qv1KsPIt7%2Bof%2FBy1dCiBcBY5Ce%2Ft63ln23ktyUW6zK0%3D Vulnerable Package
5		CVE-2026-26996	Npm-minimatch-3.1.2	details Recommended version: 3.1.4 Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions prior to 3.1.3, 4.0.0 prior to 4.2... Attack Vector: NETWORK Attack Complexity: LOW ID: MvraSUnlV%2B%2BnD9YRYvyK0hLotvImgionFGP%2Fc1DnjFc%3D Vulnerable Package
6		CVE-2026-27903	Npm-minimatch-3.1.2	details Recommended version: 3.1.4 Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ... Attack Vector: NETWORK Attack Complexity: LOW ID: tekchNuDOX5yHxlAhPZ9a%2BafNeTjzohakUlHriwxPuU%3D Vulnerable Package
7		CVE-2026-27904	Npm-minimatch-3.1.2	details Recommended version: 3.1.4 Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ... Attack Vector: NETWORK Attack Complexity: LOW ID: gVRBL6KrQycFAiZGSBXHT45tAqruLvqowH73WzCaKQY%3D Vulnerable Package
8		CVE-2026-32141	Npm-flatted-3.2.7	details Recommended version: 3.4.0 Description: flatted is a circular JSON parser. Prior to 3.4.0, flatted's "parse()" function uses a recursive "revive()" phase to resolve circular references in... Attack Vector: NETWORK Attack Complexity: LOW ID: b8q5ezAFS%2FplGqw9G%2Bv9YjnIpryD6J%2FeB%2BfyoQ%2BhHmA%3D Vulnerable Package
9		Passwords And Secrets - Generic Secret	/docker-compose.yaml: 48	details Query to find passwords and secrets in infrastructure code. ID: XS6TYNn5u0g7jTiGz3BylPry9U8%3D
10		Memory Not Limited	/docker-compose.yaml: 4	details Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than ... ID: MzPZ0jTiyuQtT%2B81zlRApkCYJhc%3D
11		Memory Not Limited	/docker-compose.yaml: 19	details Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than ... ID: %2BbHqyR84xogGtgL5Cneja4uDtDo%3D
12		CVE-2025-69873	Npm-ajv-6.12.6	details Recommended version: 6.14.0 Description: ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the "$data" option is... Attack Vector: LOCAL Attack Complexity: HIGH ID: rNPQo0pThP9evQuDf7QdTzOm1U6frBJfiyh3TFEf6Yk%3D Vulnerable Package
13		Cpus Not Limited	/docker-compose.yaml: 4	details CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests ID: mfmN5pFEUJC48DomKryTCnm7lkY%3D
14		Cpus Not Limited	/docker-compose.yaml: 19	details CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests ID: mnLPenoxG1clW%2ByxvCAvcWPZnbQ%3D

---

Fixed Issues (16)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CVE-2025-29927	Npm-next-13.0.6
	CVE-2023-46298	Npm-next-13.0.6
	CVE-2024-47831	Npm-next-13.0.6
	CVE-2024-51479	Npm-next-13.0.6
	CVE-2025-57822	Npm-next-13.0.6
	CVE-2023-44270	Npm-postcss-8.4.20
	CVE-2023-44270	Npm-postcss-8.4.14
	CVE-2024-55565	Npm-nanoid-3.3.4
	CVE-2024-56332	Npm-next-13.0.6
	CVE-2025-57752	Npm-next-13.0.6
	Memory Not Limited	/docker-compose.yaml: 19
	Memory Not Limited	/docker-compose.yaml: 4
	CVE-2025-48068	Npm-next-13.0.6
	CVE-2025-55173	Npm-next-13.0.6
	Cpus Not Limited	/docker-compose.yaml: 19
	Cpus Not Limited	/docker-compose.yaml: 4

---

Communicate with Checkmarx by submitting a PR comment with @Checkmarx followed by one of the supported commands. Learn about the supported commands here.