CVE-2018-18282 Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page
MediumCVSS 6.1
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm next(npm) | >= 7.0.0, < 7.0.2 | 7.0.2 |
| zeit next.js | = 7.0.0 | No fix listed |
| zeit next.js | = 7.0.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com
- github.com release-notes vendor-advisory