fix for Next.js CVE-2026-23869 (#1184)

Author: vicb

.changeset/fair-nails-retire.md

@@ -0,0 +1,9 @@
+---
+"@opennextjs/cloudflare": patch
+---
+
+fix for Next.js CVE-2026-23869
+
+See the [CVE-2026-23869 summary](https://vercel.com/changelog/summary-of-cve-2026-23869) for details.
+
+This CVE is fixed by bumping the minium Next.js release version to 15.5.15/16.2.3

examples/bugs/gh-119/package.json

@@ -14,7 +14,7 @@
 		"cf-typegen": "wrangler types --env-interface CloudflareEnv"
 	},
 	"dependencies": {
-		"next": "15.5.10",
+		"next": "15.5.15",
 		"react-dom": "^18.3.1",
 		"react": "^18.3.1"
 	},

examples/bugs/gh-219/package.json

@@ -28,7 +28,7 @@
 		"nanoid": "^5.0.9",
 		"next-auth": "^4.24.11",
 		"next-themes": "^0.4.4",
-		"next": "15.5.10",
+		"next": "15.5.15",
 		"qrcode.react": "^4.2.0",
 		"react-dom": "^19.0.4",
 		"react-hook-form": "^7.54.2",

examples/bugs/gh-223/package.json

@@ -16,7 +16,7 @@
 	"dependencies": {
 		"@aws-sdk/client-s3": "^3.971.0",
 		"@aws-sdk/s3-request-presigner": "^3.971.0",
-		"next": "15.5.10",
+		"next": "15.5.15",
 		"react": "^19.0.4",
 		"react-dom": "^19.0.4"
 	},

examples/playground15/package.json

@@ -16,7 +16,7 @@
 		"cf-typegen": "wrangler types --env-interface CloudflareEnv"
 	},
 	"dependencies": {
-		"next": "^15.5.10",
+		"next": "^15.5.15",
 		"react": "^19.0.4",
 		"react-dom": "^19.0.4"
 	},

examples/playground16/package.json

@@ -17,7 +17,7 @@
 		"cf-typegen": "wrangler types --env-interface CloudflareEnv"
 	},
 	"dependencies": {
-		"next": "16.1.5",
+		"next": "16.2.3",
 		"react-dom": "19.2.4",
 		"react": "19.2.4"
 	},

examples/ssg-app/package.json

@@ -15,7 +15,7 @@
 	"dependencies": {
 		"react": "^19.0.4",
 		"react-dom": "^19.0.4",
-		"next": "15.5.10"
+		"next": "15.5.15"
 	},
 	"devDependencies": {
 		"@opennextjs/cloudflare": "workspace:*",

packages/cloudflare/package.json

@@ -87,6 +87,6 @@
 	},
 	"peerDependencies": {
 		"wrangler": "catalog:",
-		"next": "~15.0.8 || ~15.1.12 || ~15.2.9 || ~15.3.9 || ~15.4.11 || ~15.5.10 || ~16.0.11 || ^16.1.5"
+		"next": ">=15.5.15 || >=16.2.3"
 	}
 }