GHSA-jcc7-9wpm-mj36 Next.js: null origin can bypass dev HMR websocket CSRF checks

• npm next: >= 16.0.1, < 16.1.7 → fixed in 16.1.7

Summary In `next dev`, cross-site protections for internal development endpoints could treat `Origin: null` as a bypass case even when `allowedDevOrigins` is configured. This could allow privacy-sensitive or opaque browser contexts, such as sandboxed documents, to access privileged internal dev-server functionality unexpectedly. Impact If a developer visits attacker-controlled content while running an affected `next dev` server with `allowedDevOrigins` configured, attacker-controlled browser code may be able to connect to internal development endpoints and interact with sensitive dev-server functionality that should have remained blocked. This issue affects development mode only. It does not affect `next start`, and it does not expose internal debugging functionality to the network by default. Patches Fixed by validating `Origin: null` through the same cross-site origin-allowance checks used for other origins on internal development endpoints. Workarounds If upgrade is not immediately possible: • Do not expose `next dev` to untrusted networks. • If you use `allowedDevOrigins`, reject requests and websocket upgrades with `Origin: null` for internal dev endpoints at your proxy.