CVE-2017-16877
High · 7.5CVSS
7.5
EPSS
14.1%
Published
Nov 17, 2017
CISA due date
—
The record
ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | next | 1.0.0 | 2.4.1 |
Related vulnerabilities
- CVE-2026-44582 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-45109 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44581 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44580 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44579 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44578 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44576 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44577 Next.js is a React framework for building full-stack web applications. Also affects next