Skip to content

CVE-2017-16877 Next.js Directory Traversal Vulnerability

HighCVSS 7.5 EPSS 14.1%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.

Affected products

ProductAffected versionsFixed in
npm next(npm) >= 1.0.0, < 2.4.1 2.4.1
zeit next.js < 2.4.1 2.4.1

References