Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page

MEDIUM 6.1CVE-2018-18282 · GHSA-qw96-mm2g-c8m7 · Published 12/10/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
next.js zeit	`= 7.0.0= 7.0.1`	No fix yet
next npm	`≥ 7.0.0, < 7.0.2`	`7.0.2`

Description

Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.

NVD description

Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.