GCVE - cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*

part: a version: * update: *

Notes

Imported from purl2cpe mapping

PURL	Source	Last updated
`pkg:github/vercel/next.js`	purl2cpe	2026-06-01 10:12:39.358127

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-5284`	vulnerable	2026-06-08 05:26:41.670007	Directory Traversal in Next.js versions below 9.3.2 MEDIUM (4.4) Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2. Published: 2020-03-30T20:40:11.000Z Updated: 2024-08-04T08:22:09.087Z Open on db.gcve.eu Reference links https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj https://github.com/zeit/next.js/releases/tag/v9.3.2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-16877`	vulnerable	2026-06-08 05:09:07.495508	Details available ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information. Published: 2017-11-17T17:00:00.000Z Updated: 2024-09-17T02:31:11.770Z Open on db.gcve.eu Reference links https://github.com/zeit/next.js/releases/tag/2.4.1 https://github.com/vercel/next.js/commit/02fe7cf63f6265d73bdaf8bc50a4f2fb539dcd00	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.