Packages / next / Security

ModerateVulnerabilityGHSA-fq77-7p7r-83rjCVE-2020-5284Published 30 Mar 2020

Directory Traversal in Next.js

Affected releases · next

  • 9.x9.0.0 – 9.3.1Fixed in 9.3.2
  • 8.x and older0.9.9 – 8.1.0No fix, no longer updated

On 9.x, the newest line:

npm install next@9.3.2
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

9.x

  1. Affected

    9.0.0 – 9.3.1

    22 releases

  2. Fixed

    9.3.2 – 9.5.5

    16 releases

8.x

  1. Affected

    8.0.0 – 8.1.0

    6 releases

7.x

  1. Affected

    7.0.0 – 7.0.3

    4 releases

6.x

  1. Affected

    6.0.0 – 6.1.2

    7 releases

5.x

  1. Affected

    5.0.0 – 5.1.0

    2 releases

4.x

  1. Affected

    4.0.0 – 4.2.3

    15 releases

3.x

  1. Affected

    3.0.1 – 3.2.3

    11 releases

2.x

  1. Affected

    2.0.0 – 2.4.9

    17 releases

1.x

  1. Affected

    1.0.0 – 1.2.3

    10 releases

0.x

  1. Not affected

    0.1.0 – 0.4.1

    23 releases

  2. Affected

    0.9.9 – 0.9.11

    3 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

  • Not affected: Deployments on ZEIT Now v2 (https://zeit.co) are not affected

  • Not affected: Deployments using the serverless target

  • Not affected: Deployments using next export

  • Affected: Users of Next.js below 9.3.2

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

Patches

github.com/zeit/next.js/releases/tag/v9.3.2

References

github.com/zeit/next.js/releases/tag/v9.3.2