Packages / next / Security

HighVulnerabilityGHSA-3f5c-4qxj-vmpfCVE-2017-16877Published 5 Dec 2017

Next.js Directory Traversal Vulnerability

Affected releases · next

  • 2.x2.0.0 – 2.4.0Fixed in 2.4.1
  • 1.x1.0.0 – 1.2.3No fix on this line yet

On 2.x, the newest line:

npm install next@2.4.1
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

2.x

  1. Affected

    2.0.0 – 2.4.0

    8 releases

  2. Fixed

    2.4.1 – 2.4.9

    9 releases

1.x

  1. Affected

    1.0.0 – 1.2.3

    10 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.