🔒 Security fix: denial of service through Server Actions
This patch fixes a high severity vulnerability in an upstream dependency. Please upgrade as soon as possible.
Rallly v4.15.4 and earlier ship a version of Next.js affected by GHSA-p3m5-59mp-jv5r (high). A crafted request to a Server Action can tie up the server's CPU so it stops answering other requests.
Rallly uses Server Actions throughout, and the request needs no sign in, so anyone who can reach your instance can send it.
This release upgrades Next.js from 16.3.8 to 16.4.2, which contains the fix. Nothing else changes. There is no workaround short of upgrading.
What's Changed
- 🔒️ Upgrade Next.js to 16.4.2 to patch Server Actions DoS (#3564)
Full Changelog: v4.15.4...v4.15.5