GitHub Advisoryadvisory · npm

GHSA-fq77-7p7r-83rj Directory Traversal in Next.js

MEDIUM Published 2020-03-30 Modified 2025-09-26 Official page ↗

Aliases: CVE-2020-5284
Ecosystem: npm
Packages: next
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses: CWE-23
Reviewed: 2020-03-30

Affected packages

• npm next: >= 0.9.9, < 9.3.2 → fixed in 9.3.2

Description

Impact • Not affected: Deployments on ZEIT Now v2 (https://zeit.co) are not affected • Not affected: Deployments using the `serverless` target • Not affected: Deployments using `next export` • Affected: Users of Next.js below 9.3.2 We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. Patches https://github.com/zeit/next.js/releases/tag/v9.3.2 References https://github.com/zeit/next.js/releases/tag/v9.3.2

Related

Alias · CVE (1)

CVE-2020-5284 Next.js versions before 9.3.2 have a directory traversal vulnerability. vulnerability

Weakness · CWE (1)

CWE-23 Relative Path Traversal weakness

References