Directory Traversal in Next.js versions below 9.3.2

Summary

Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.

Timeline

1. Mar 30, 2020, 8:40 PM UTCCVE published
2. Aug 4, 2024, 8:22 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• zeit next.js

  fixed in 9.3.2

• nextnpm

  From 0.9.9 · fixed in 9.3.2

References 3