Packages / next / Security

ModerateVulnerabilityGHSA-qw96-mm2g-c8m7CVE-2018-18282Published 15 Oct 2018

Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page

Affected releases · next

  • 7.x7.0.0 – 7.0.1Fixed in 7.0.2

On 7.x, the newest line:

npm install next@7.0.2
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

7.x

  1. Affected

    7.0.0 – 7.0.1

    2 releases

  2. Fixed

    7.0.2 – 7.0.3

    2 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.