chore(nextjs): Update dependency next to v15.5.13 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
next (source)	15.5.10 → 15.5.13

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2026-29057

Summary

When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

Impact

An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.

Patches

The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so content-length: 0 is added only when both content-length and transfer-encoding are absent, and transfer-encoding is no longer removed in that code path.

Workarounds

If upgrade is not immediately possible:

• Block chunked DELETE/OPTIONS requests on rewritten routes at your edge/proxy.
• Enforce authentication/authorization on backend routes per our security guidance.

CVE-2026-27980

Summary

The default Next.js image optimization disk cache (/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.

Impact

An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.

Patches

Fixed by adding an LRU-backed disk cache with images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. Setting maximumDiskCacheSize: 0 disables disk caching.

Workarounds

If upgrade is not immediately possible:

• Periodically clean .next/cache/images.
• Reduce variant cardinality (e.g., tighten values for images.localPatterns, images.remotePatterns, and images.qualities)

---

Release Notes

vercel/next.js (next)

v15.5.13

Compare Source

v15.5.12

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

• fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

v15.5.11

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Tracing: Fix memory leak in span map (#​85529)
• fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#​89134)
• Turbopack: fix NFT tracing of sharp 0.34 (#​82340)
• Turbopack: support pattern into exports field (#​82757)
• NFT tracing fixes (#​84155 and #​85323)
• Turbopack: validate CSS without computing all paths (#​83810)
• feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#​89129)

Credits

Huge thanks to @​timneutkens, @​mischnic, @​ztanner, and @​wyattjoh for helping!

---

Configuration

📅 Schedule: (in timezone GMT)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

<--- Last few GCs --->

[909:0x3e2e4000]    90858 ms: Scavenge (interleaved) 1494.8 (1525.5) -> 1494.8 (1530.5) MB, pooled: 0 MB, 61.36 / 0.00 ms  (average mu = 0.310, current mu = 0.244) allocation failure; 
[909:0x3e2e4000]    92547 ms: Mark-Compact (reduce) 1497.8 (1530.5) -> 1497.8 (1527.5) MB, pooled: 0 MB, 888.83 / 0.00 ms  (+ 584.0 ms in 0 steps since start of marking, biggest step 0.0 ms, walltime since start of marking 1518 ms) (average mu = 0.298, cu

<--- JS stacktrace --->

FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----

 1: 0xe42d60 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
 2: 0x121ded0 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
 3: 0x121e1a7 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
 4: 0x144d015  [/opt/containerbase/tools/node/22.22.2/bin/node]
 5: 0x14668a9 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [/opt/containerbase/tools/node/22.22.2/bin/node]
 6: 0x143afa8 v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
 7: 0x143bed5 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
 8: 0x1414735 v8::internal::Factory::AllocateRawWithAllocationSite(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
 9: 0x14219e8 v8::internal::Factory::NewJSObjectFromMap(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
10: 0x157a312 v8::internal::Handle<v8::internal::Object> v8::internal::JSDataObjectBuilder::BuildFromIterator<v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&>(v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&, v8::internal::MaybeHandle<v8::internal::FixedArrayBase>) [/opt/containerbase/tools/node/22.22.2/bin/node]
11: 0x157ba4f v8::internal::JsonParser<unsigned char>::BuildJsonObject(v8::internal::JsonParser<unsigned char>::JsonContinuation const&, v8::base::SmallVector<v8::internal::JsonProperty, 16ul, std::allocator<v8::internal::JsonProperty> > const&, v8::internal::Handle<v8::internal::Map>) [/opt/containerbase/tools/node/22.22.2/bin/node]
12: 0x157f674  [/opt/containerbase/tools/node/22.22.2/bin/node]
13: 0x1581cfd v8::internal::JsonParser<unsigned char>::ParseJson(v8::internal::Handle<v8::internal::Object>) [/opt/containerbase/tools/node/22.22.2/bin/node]
14: 0x129bda9 v8::internal::Builtin_JsonParse(int, unsigned long*, v8::internal::Isolate*) [/opt/containerbase/tools/node/22.22.2/bin/node]
15: 0x1dd5a36  [/opt/containerbase/tools/node/22.22.2/bin/node]
/usr/local/bin/node: line 18:   909 Aborted                 /opt/containerbase/tools/node/22.22.2/bin/node "$@"

[changeset-bot]

🦋 Changeset detected

Latest commit: b1c679e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@clerk/nextjs	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Apr 8, 2026 9:45pm

[pkg-pr-new]

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@8257

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8257

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8257

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8257

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8257

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8257

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8257

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8257

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8257

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8257

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8257

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8257

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8257

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8257

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8257

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8257

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8257

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8257

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8257

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8257

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8257

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8257

commit: b1c679e

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.