GitHub Advisoryadvisory · npm

GHSA-3f5c-4qxj-vmpf Next.js Directory Traversal Vulnerability

HIGH Published 2017-12-05 Modified 2024-04-22 Official page ↗

Aliases: CVE-2017-16877
Ecosystem: npm
Packages: next
Severity: High
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-22
Reviewed: 2020-06-16

Affected packages

• npm next: >= 1.0.0, < 2.4.1 → fixed in 2.4.1

Description

Next.js before 2.4.1 has directory traversal under the `/_next` and `/static` request namespace, allowing attackers to obtain sensitive information.

Related

Alias · CVE (1)

CVE-2017-16877 ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive… vulnerability

Weakness · CWE (1)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References