GitHub Advisoryadvisory · npm

GHSA-m34x-wgrh-g897 Directory traversal vulnerability in Next.js

HIGH Published 2018-01-24 Modified 2022-04-28 Official page ↗
Aliases
CVE-2018-6184
Ecosystem
npm
Packages
next
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• npm next: >= 1.0.0, < 4.2.3 → fixed in 4.2.3

Description

Next.js 4 before 4.2.3 has Directory Traversal under the `/_next` request namespace.

Related

Alias · CVE (1)

  • CVE-2018-6184 ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References