[Pattern Security Automation (pattern-security-automation)]

Supply Chain Vulnerability — Auto-Remediation PR

This PR was automatically generated by Pattern Security Automation.
Please review the dependency change and ensure CI passes before merging.

---

CVE Details

Field	Value
CVE	CVE-2026-96889
Severity	CRITICAL
Repository	patterninc/heimdall
Vulnerable package	next
Fixed version	16.4.1
Dependency type	Direct
Previous version	16.3.8
Language	javascript

What Changed

next: 16.3.8 → 16.4.1

• web/package.json
• web/pnpm-lock.yaml

Lock File Status

Lock file updated

CI Validation

This PR relies on the repository's existing CI pipeline to validate that the
dependency update does not break tests. Please ensure all checks pass before merging.

False positive?

If you've reviewed this and the CVE is not actually exploitable here, add the
wiz-false-positive label to this PR before closing it. The auto-remediation
pipeline will record the false positive, stop re-flagging this CVE, and (if enabled)
mark it rejected in Wiz.

AI Triage Analysis

Verdict: True Positive

Reasoning: The next package version 16.3.8 is listed as a direct dependency in web/package.json and is actively used throughout the codebase. Multiple source files import from next/dynamic, next/link, and next/navigation, confirming the Next.js framework is central to the web application. The installed version 16.3.8 falls within the vulnerable range (>= 16.0.0, < 16.4.1) per the advisory. Note that the CVE description mentions librsvg/XML processing which seems mismatched with a Next.js advisory, but the Wiz description explicitly references GHSA-2464-fhr4-w9xw for Next.js at this version, so the finding appears legitimate as a Next.js vulnerability regardless of the description mismatch.

References

• View in Wiz

Developer feedback

Was this automation helpful? Share feedback (takes ~1 min)

---

Auto-generated by Pattern Security Automation