CVE-2025-55184 #603

VaguelySerious · 2025-12-13T02:58:06Z

No description provided.

changeset-bot · 2025-12-13T02:58:11Z

⚠️ No Changeset found

Latest commit: de2bfb8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2025-12-13T02:58:11Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
workbench-astro-workflow	Ready	Preview, Comment	Dec 13, 2025 2:59am
workbench-express-workflow	Ready	Preview, Comment	Dec 13, 2025 2:59am
workbench-fastify-workflow	Ready	Preview, Comment	Dec 13, 2025 2:59am
workbench-hono-workflow	Ready	Preview, Comment	Dec 13, 2025 2:59am
workbench-nuxt-workflow	Ready	Preview, Comment	Dec 13, 2025 2:59am
workbench-sveltekit-workflow	Ready	Preview, Comment	Dec 13, 2025 2:59am
workbench-vite-workflow	Ready	Preview, Comment	Dec 13, 2025 2:59am

github-actions · 2025-12-13T02:58:17Z

🧪 E2E Test Results

❌ Some tests failed

Summary

	Passed	Failed	Skipped	Total
❌ ▲ Vercel Production	173	2	7	182
✅ 💻 Local Development	252	0	8	260
✅ 📦 Local Production	252	0	8	260
✅ 🐘 Local Postgres	252	0	8	260
✅ 🪟 Windows	26	0	0	26
❌ 🌍 Community Worlds	105	11	0	116
Total	1060	13	31	1104

❌ Failed Tests

▲ Vercel Production (2 failed)

express (1 failed):

hookWorkflow

fastify (1 failed):

outputStreamInsideStepWorkflow - getWritable() called inside step functions

🌍 Community Worlds (11 failed)

mongodb (1 failed):

webhookWorkflow

redis (1 failed):

webhookWorkflow

starter (8 failed):

addTenWorkflow
addTenWorkflow
retryAttemptCounterWorkflow
crossFileErrorWorkflow - stack traces work across imported modules
hookCleanupTestWorkflow - hook token reuse after workflow completion
stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

turso (1 failed):

webhookWorkflow

Details by Category

❌ ▲ Vercel Production

App	Passed	Failed	Skipped
✅ astro	25	0	1
❌ express	24	1	1
❌ fastify	24	1	1
✅ hono	25	0	1
✅ nuxt	25	0	1
✅ sveltekit	25	0	1
✅ vite	25	0	1

✅ 💻 Local Development

App	Passed	Skipped
✅ astro-stable	25	1
✅ express-stable	25	1
✅ fastify-stable	25	1
✅ hono-stable	25	1
✅ nextjs-turbopack-stable	26	0
✅ nextjs-webpack-stable	26	0
✅ nitro-stable	25	1
✅ nuxt-stable	25	1
✅ sveltekit-stable	25	1
✅ vite-stable	25	1

✅ 📦 Local Production

App	Passed	Skipped
✅ astro-stable	25	1
✅ express-stable	25	1
✅ fastify-stable	25	1
✅ hono-stable	25	1
✅ nextjs-turbopack-stable	26	0
✅ nextjs-webpack-stable	26	0
✅ nitro-stable	25	1
✅ nuxt-stable	25	1
✅ sveltekit-stable	25	1
✅ vite-stable	25	1

✅ 🐘 Local Postgres

App	Passed	Skipped
✅ astro-stable	25	1
✅ express-stable	25	1
✅ fastify-stable	25	1
✅ hono-stable	25	1
✅ nextjs-turbopack-stable	26	0
✅ nextjs-webpack-stable	26	0
✅ nitro-stable	25	1
✅ nuxt-stable	25	1
✅ sveltekit-stable	25	1
✅ vite-stable	25	1

✅ 🪟 Windows

App	Passed	Failed	Skipped
✅ nextjs-turbopack	26	0	0

❌ 🌍 Community Worlds

App	Passed	Failed
✅ mongodb-dev	3	0
❌ mongodb	25	1
✅ redis-dev	3	0
❌ redis	25	1
✅ starter-dev	3	0
❌ starter	18	8
✅ turso-dev	3	0
❌ turso	25	1

📋 View full workflow run

❌ Some E2E test jobs failed:

Vercel Prod: failure
Local Dev: success
Local Prod: success
Local Postgres: success
Windows: success

Check the workflow run for details.

github-actions · 2025-12-13T02:58:19Z

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

World	Framework	Workflow Time	Wall Time	Overhead	Samples	vs Fastest
🌐 Starter	🥇 Next.js (Turbopack)	0.039s (+5.3% 🔺)	1.014s (~)	0.975s	10	1.00x
💻 Local	Next.js (Turbopack)	0.041s (+2.8%)	1.017s (~)	0.977s	10	1.03x
💻 Local	Nitro	0.043s (~)	1.006s (~)	0.963s	10	1.08x
💻 Local	Express	0.043s (-8.5% 🟢)	1.007s (~)	0.964s	10	1.10x
🌐 Redis	Next.js (Turbopack)	0.044s (+12.4% 🔺)	1.018s (~)	0.974s	10	1.12x
🌐 MongoDB	Next.js (Turbopack)	0.055s (-11.3% 🟢)	1.016s (~)	0.961s	10	1.39x
🌐 Turso	Next.js (Turbopack)	0.114s (+12.3% 🔺)	1.016s (~)	0.902s	10	2.90x
🐘 Postgres	Nitro	0.122s (-63.4% 🟢)	1.012s (-2.0%)	0.890s	10	3.09x
🐘 Postgres	Next.js (Turbopack)	0.184s (-51.1% 🟢)	1.019s (~)	0.835s	10	4.66x
🐘 Postgres	Express	0.376s (-2.8%)	1.013s (~)	0.637s	10	9.54x

▲ Production (Vercel)

World	Framework	Workflow Time	Wall Time	Overhead	Samples	vs Fastest
▲ Vercel	🥇 Express	0.801s (+28.7% 🔺)	1.706s (+0.5%)	0.905s	10	1.00x
▲ Vercel	Next.js (Turbopack)	⚠️ missing	-	-	-	-
▲ Vercel	Nitro	⚠️ missing	-	-	-	-

🔍 Observability: Express

workflow with 1 step

💻 Local Development

World	Framework	Workflow Time	Wall Time	Overhead	Samples	vs Fastest
💻 Local	🥇 Next.js (Turbopack)	1.090s (~)	2.012s (~)	0.921s	10	1.00x
🌐 Starter	Next.js (Turbopack)	1.091s (~)	2.009s (~)	0.918s	10	1.00x
🌐 Redis	Next.js (Turbopack)	1.109s (+0.8%)	2.013s (~)	0.904s	10	1.02x
💻 Local	Nitro	1.110s (~)	2.006s (~)	0.895s	10	1.02x
💻 Local	Express	1.114s (~)	2.007s (~)	0.893s	10	1.02x
🌐 Turso	Next.js (Turbopack)	1.288s (-2.1%)	2.014s (~)	0.725s	10	1.18x
🌐 MongoDB	Next.js (Turbopack)	1.307s (-0.7%)	2.013s (~)	0.706s	10	1.20x
🐘 Postgres	Next.js (Turbopack)	1.915s (+10.6% 🔺)	2.016s (~)	0.100s	10	1.76x
🐘 Postgres	Express	2.236s (~)	3.014s (~)	0.778s	10	2.05x
🐘 Postgres	Nitro	2.480s (+1.7%)	3.014s (~)	0.534s	10	2.27x

▲ Production (Vercel)

World	Framework	Workflow Time	Wall Time	Overhead	Samples	vs Fastest
▲ Vercel	🥇 Express	2.581s (-2.4%)	3.607s (-1.0%)	1.025s	10	1.00x
▲ Vercel	Next.js (Turbopack)	⚠️ missing	-	-	-	-
▲ Vercel	Nitro	⚠️ missing	-	-	-	-

🔍 Observability: Express

workflow with 10 sequential steps

💻 Local Development

World	Framework	Workflow Time	Wall Time	Overhead	Samples	vs Fastest
🌐 Starter	🥇 Next.js (Turbopack)	10.580s (~)	11.011s (~)	0.431s	5	1.00x
💻 Local	Next.js (Turbopack)	10.671s (~)	11.017s (~)	0.345s	5	1.01x
🌐 Redis	Next.js (Turbopack)	10.676s (~)	11.021s (~)	0.345s	5	1.01x
💻 Local	Express	10.786s (~)	11.012s (~)	0.226s	5	1.02x
💻 Local	Nitro	10.796s (~)	11.014s (~)	0.218s	5	1.02x
🌐 Turso	Next.js (Turbopack)	12.246s (~)	13.031s (~)	0.785s	5	1.16x
🌐 MongoDB	Next.js (Turbopack)	12.283s (~)	13.027s (~)	0.744s	5	1.16x
🐘 Postgres	Next.js (Turbopack)	15.274s (+3.5%)	16.035s (+5.3% 🔺)	0.761s	5	1.44x
🐘 Postgres	Nitro	17.324s (-4.3%)	18.038s (-3.2%)	0.715s	5	1.64x
🐘 Postgres	Express	20.141s (-0.7%)	21.032s (~)	0.891s	5	1.90x

▲ Production (Vercel)

World	Framework	Workflow Time	Wall Time	Overhead	Samples	vs Fastest
▲ Vercel	🥇 Express	21.720s (+5.0%)	23.034s (+7.8% 🔺)	1.314s	5	1.00x
▲ Vercel	Next.js (Turbopack)	⚠️ missing	-	-	-	-
▲ Vercel	Nitro	⚠️ missing	-	-	-	-

🔍 Observability: Express

workflow with 10 parallel steps

💻 Local Development

World	Framework	Workflow Time	Wall Time	Overhead	Samples	vs Fastest
🌐 Starter	🥇 Next.js (Turbopack)	1.345s (-0.7%)	2.008s (~)	0.663s	5	1.00x
🌐 Redis	Next.js (Turbopack)	1.347s (+1.1%)	2.011s (~)	0.664s	5	1.00x
💻 Local	Next.js (Turbopack)	1.366s (+1.0%)	2.010s (~)	0.644s	5	1.02x
💻 Local	Express	1.381s (~)	2.007s (~)	0.627s	5	1.03x
💻 Local	Nitro	1.390s (~)	2.006s (~)	0.616s	5	1.03x
🐘 Postgres	Next.js (Turbopack)	1.849s (-5.3% 🟢)	2.015s (-16.7% 🟢)	0.166s	5	1.37x
🌐 Turso	Next.js (Turbopack)	2.137s (-3.7%)	3.013s (-0.5%)	0.877s	5	1.59x
🌐 MongoDB	Next.js (Turbopack)	2.139s (-0.7%)	3.015s (~)	0.876s	5	1.59x
🐘 Postgres	Nitro	2.324s (+24.0% 🔺)	3.012s (+36.3% 🔺)	0.688s	5	1.73x
🐘 Postgres	Express	2.643s (-0.8%)	3.016s (~)	0.373s	5	1.97x

▲ Production (Vercel)

World	Framework	Workflow Time	Wall Time	Overhead	Samples	vs Fastest
▲ Vercel	🥇 Express	3.921s (-2.1%)	4.745s (-5.7% 🟢)	0.824s	5	1.00x
▲ Vercel	Next.js (Turbopack)	⚠️ missing	-	-	-	-
▲ Vercel	Nitro	⚠️ missing	-	-	-	-

🔍 Observability: Express

stress test: Promise.all with 100 concurrent steps

💻 Local Development

World	Framework	Workflow Time	Wall Time	Overhead	Samples	vs Fastest
🌐 Starter	🥇 Next.js (Turbopack)	6.561s (+1.0%)	7.081s (+2.2%)	0.520s	5	1.00x
🌐 Redis	Next.js (Turbopack)	8.302s (+5.4% 🔺)	8.818s (+7.5% 🔺)	0.516s	4	1.27x
🐘 Postgres	Next.js (Turbopack)	8.540s (~)	8.962s (~)	0.422s	4	1.30x
🐘 Postgres	Nitro	8.667s (-3.7%)	9.086s (-3.6%)	0.419s	4	1.32x
🐘 Postgres	Express	8.889s (~)	9.235s (-2.8%)	0.346s	4	1.35x
💻 Local	Express	13.525s (+0.6%)	13.631s (~)	0.106s	3	2.06x
💻 Local	Nitro	13.875s (+5.3% 🔺)	14.018s (+5.8% 🔺)	0.143s	3	2.11x
💻 Local	Next.js (Turbopack)	14.302s (+2.0%)	14.401s (~)	0.099s	3	2.18x
🌐 MongoDB	Next.js (Turbopack)	20.145s (+1.2%)	20.527s (~)	0.382s	2	3.07x
🌐 Turso	Next.js (Turbopack)	20.177s (+1.6%)	20.585s (~)	0.408s	2	3.08x

▲ Production (Vercel)

World	Framework	Workflow Time	Wall Time	Overhead	Samples	vs Fastest
▲ Vercel	🥇 Express	16.129s (-20.5% 🟢)	17.043s (-18.2% 🟢)	0.914s	2	1.00x
▲ Vercel	Next.js (Turbopack)	⚠️ missing	-	-	-	-
▲ Vercel	Nitro	⚠️ missing	-	-	-	-

🔍 Observability: Express

stress test: Promise.race with 100 concurrent steps

💻 Local Development

World	Framework	Workflow Time	Wall Time	Overhead	Samples	vs Fastest
🌐 Starter	🥇 Next.js (Turbopack)	6.598s (-0.9%)	6.794s (-1.9%)	0.196s	5	1.00x
🌐 Redis	Next.js (Turbopack)	8.928s (+10.0% 🔺)	9.260s (+9.7% 🔺)	0.332s	4	1.35x
🐘 Postgres	Express	8.946s (-7.6% 🟢)	9.418s (-4.7%)	0.472s	4	1.36x
🐘 Postgres	Next.js (Turbopack)	9.444s (+6.8% 🔺)	9.757s (+4.2%)	0.313s	4	1.43x
🐘 Postgres	Nitro	9.456s (-4.2%)	9.781s (-2.8%)	0.325s	4	1.43x
💻 Local	Next.js (Turbopack)	14.733s (-10.8% 🟢)	15.008s (-10.8% 🟢)	0.275s	2	2.23x
💻 Local	Express	15.201s (+8.9% 🔺)	15.524s (+8.9% 🔺)	0.323s	3	2.30x
💻 Local	Nitro	15.254s (+9.5% 🔺)	15.424s (+10.0% 🔺)	0.171s	2	2.31x
🌐 MongoDB	Next.js (Turbopack)	19.721s (-2.2%)	20.024s (-2.5%)	0.303s	2	2.99x
🌐 Turso	Next.js (Turbopack)	20.735s (+3.3%)	21.058s (+2.3%)	0.322s	2	3.14x

▲ Production (Vercel)

World	Framework	Workflow Time	Wall Time	Overhead	Samples	vs Fastest
▲ Vercel	🥇 Express	16.819s (-14.6% 🟢)	17.969s (-13.3% 🟢)	1.150s	2	1.00x
▲ Vercel	Next.js (Turbopack)	⚠️ missing	-	-	-	-
▲ Vercel	Nitro	⚠️ missing	-	-	-	-

🔍 Observability: Express

Stream Benchmarks (includes TTFB metrics)

workflow with stream

💻 Local Development

World	Framework	Workflow Time	TTFB	Slurp	Wall Time	Overhead	Samples	vs Fastest
🌐 Starter	🥇 Next.js (Turbopack)	0.129s (+1.9%)	1.005s (~)	0.000s (+Infinity% 🔺)	1.010s (~)	0.881s	10	1.00x
💻 Local	Next.js (Turbopack)	0.137s (-1.6%)	1.003s (~)	0.016s (+8.6% 🔺)	1.027s (~)	0.890s	10	1.06x
🌐 Redis	Next.js (Turbopack)	0.148s (+8.1% 🔺)	1.005s (~)	0.000s (+200.0% 🔺)	1.014s (~)	0.866s	10	1.15x
💻 Local	Nitro	0.174s (+0.8%)	0.993s (~)	0.014s (+0.7%)	1.020s (~)	0.846s	10	1.35x
💻 Local	Express	0.176s (+1.7%)	0.992s (~)	0.017s (+16.0% 🔺)	1.023s (~)	0.847s	10	1.36x
🌐 MongoDB	Next.js (Turbopack)	0.495s (-3.4%)	0.954s (+1.7%)	0.000s (+Infinity% 🔺)	1.013s (~)	0.518s	10	3.83x
🌐 Turso	Next.js (Turbopack)	0.500s (+4.9%)	0.959s (-2.6%)	0.000s (+Infinity% 🔺)	1.013s (~)	0.514s	10	3.88x
🐘 Postgres	Nitro	1.038s (+2.0%)	1.668s (-4.6%)	0.001s (+400.0% 🔺)	1.713s (-5.5% 🟢)	0.675s	10	8.05x
🐘 Postgres	Next.js (Turbopack)	1.191s (+26.5% 🔺)	1.638s (+101.1% 🔺)	0.000s (~)	1.818s (+63.0% 🔺)	0.627s	10	9.23x
🐘 Postgres	Express	2.173s (-6.1% 🟢)	2.369s (-13.3% 🟢)	0.000s (+100.0% 🔺)	2.714s (-10.0% 🟢)	0.541s	10	16.85x

▲ Production (Vercel)

World	Framework	Workflow Time	TTFB	Slurp	Wall Time	Overhead	Samples	vs Fastest
▲ Vercel	🥇 Express	2.678s (+9.8% 🔺)	3.193s (+9.2% 🔺)	0.275s (-16.2% 🟢)	3.930s (+7.8% 🔺)	1.252s	10	1.00x
▲ Vercel	Next.js (Turbopack)	⚠️ missing	-	-	-	-	-
▲ Vercel	Nitro	⚠️ missing	-	-	-	-	-

🔍 Observability: Express

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World	🥇 Fastest Framework	Wins
💻 Local	Next.js (Turbopack)	6/7
🐘 Postgres	Next.js (Turbopack)	4/7
▲ Vercel	Express	7/7

Fastest World by Framework

Winner determined by most benchmark wins

Framework	🥇 Fastest World	Wins
Express	💻 Local	5/7
Next.js (Turbopack)	🌐 Starter	6/7
Nitro	💻 Local	5/7

Column Definitions

Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
Wall Time: Total testbench time (trigger workflow + poll for result)
Overhead: Testbench overhead (Wall Time - Workflow Time)
Samples: Number of benchmark iterations run
vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

💻 Local: In-memory filesystem world (local development)
🐘 Postgres: PostgreSQL database world (local development)
▲ Vercel: Vercel production/preview deployment
🌐 Starter: Community world (local development)
🌐 Turso: Community world (local development)
🌐 MongoDB: Community world (local development)
🌐 Redis: Community world (local development)
🌐 Jazz: Community world (local development)

📋 View full workflow run

❌ Some benchmark jobs failed:

Local: success
Postgres: success
Vercel: failure

Check the workflow run for details.

* main: [web] Add actions for waking up workflow from sleep and re-enqueue runs for debugging (vercel#582) Override timeout functions in workflow VM context to throw helpful errors (vercel#505) [docs] bump @ai/react version to stop schema validation errors (vercel#606) Update README.md (vercel#601) Version Packages (beta) (vercel#605) CVE-2025-55184 changeset (vercel#604) CVE-2025-55184 (vercel#603) Version Packages (beta) (vercel#589)

CVE-2025-55184

de2bfb8

vercel bot deployed to Preview – workbench-astro-workflow December 13, 2025 02:59 View deployment

vercel bot deployed to Preview – workbench-fastify-workflow December 13, 2025 02:59 View deployment

vercel bot deployed to Preview – workbench-vite-workflow December 13, 2025 02:59 View deployment

vercel bot deployed to Preview – workbench-hono-workflow December 13, 2025 02:59 View deployment

vercel bot deployed to Preview – workbench-express-workflow December 13, 2025 02:59 View deployment

vercel bot deployed to Preview – workbench-sveltekit-workflow December 13, 2025 02:59 View deployment

vercel bot deployed to Preview – workbench-nuxt-workflow December 13, 2025 02:59 View deployment

adriandlam approved these changes Dec 13, 2025

View reviewed changes

VaguelySerious merged commit f5db6ed into main Dec 13, 2025
73 of 81 checks passed

VaguelySerious deleted the peter/cve branch December 13, 2025 03:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

CVE-2025-55184 #603

CVE-2025-55184 #603

Uh oh!

VaguelySerious commented Dec 13, 2025

Uh oh!

changeset-bot bot commented Dec 13, 2025

Uh oh!

vercel bot commented Dec 13, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Dec 13, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Dec 13, 2025 •

edited

Loading

💻 Local Development

▲ Production (Vercel)

💻 Local Development

▲ Production (Vercel)

💻 Local Development

▲ Production (Vercel)

💻 Local Development

▲ Production (Vercel)

💻 Local Development

▲ Production (Vercel)

💻 Local Development

▲ Production (Vercel)

💻 Local Development

▲ Production (Vercel)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

CVE-2025-55184 #603

CVE-2025-55184 #603

Uh oh!

Conversation

VaguelySerious commented Dec 13, 2025

Uh oh!

changeset-bot bot commented Dec 13, 2025

⚠️ No Changeset found

Uh oh!

vercel bot commented Dec 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧪 E2E Test Results

Summary

❌ Failed Tests

Details by Category

Uh oh!

github-actions bot commented Dec 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📊 Benchmark Results

💻 Local Development

▲ Production (Vercel)

💻 Local Development

▲ Production (Vercel)

💻 Local Development

▲ Production (Vercel)

💻 Local Development

▲ Production (Vercel)

💻 Local Development

▲ Production (Vercel)

💻 Local Development

▲ Production (Vercel)

💻 Local Development

▲ Production (Vercel)

Summary

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vercel bot commented Dec 13, 2025 •

edited

Loading

github-actions bot commented Dec 13, 2025 •

edited

Loading

github-actions bot commented Dec 13, 2025 •

edited

Loading