Packages / next / Security

HighVulnerabilityGHSA-m34x-wgrh-g897CVE-2018-6184Published 24 Jan 2018

Directory traversal vulnerability in Next.js

Affected releases · next

  • 4.x4.0.0 – 4.2.2Fixed in 4.2.3
  • 3.x and older1.0.0 – 3.2.3No fix, no longer updated

On 4.x, the newest line:

npm install next@4.2.3
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

4.x

  1. Affected

    4.0.0 – 4.2.2

    14 releases

  2. Fixed

    4.2.3

    1 release

3.x

  1. Affected

    3.0.1 – 3.2.3

    11 releases

2.x

  1. Affected

    2.0.0 – 2.4.9

    17 releases

1.x

  1. Affected

    1.0.0 – 1.2.3

    10 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.