Next.js Directory Traversal Vulnerability (GHSA-3f5c-4qxj-vmpf)
Published: 2017-12-05T02:04:14Z
Aliases: CVE-2017-16877
Severity: HIGH · CWE: CWE-22

Next.js before 2.4.1 has directory traversal under the `/_next` and `/static` request namespace, allowing attackers to obtain sensitive information.

Affected packages:
package: ecosystem: npm
name: next
ranges: type: ECOSYSTEM
events: introduced: 1.0.0
fixed: 2.4.1