Directory traversal vulnerability in Next.js

HIGH 7.5CVE-2018-6184 · GHSA-m34x-wgrh-g897 · Published 24/01/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
next.js zeit	`= 4.0.0= 4.0.1= 4.0.2= 4.0.3= 4.0.4= 4.0.5= 4.1.0= 4.1.1= 4.1.2= 4.1.3= 4.1.4= 4.2.0= 4.2.1= 4.2.2`	No fix yet
next npm	`≥ 1.0.0, < 4.2.3`	`4.2.3`

Description

Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.

NVD description

ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.