What’s Vulnerable › Vulnerabilities

CVE-2020-5284: Directory Traversal in Next.js versions below 9.3.2

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 44.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-03-30 · updated 2026-06-17
• Weakness: CWE-23

Description

Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.

Affected products

• zeit next.js: before 9.3.2 — fixed in 9.3.2

How to fix

Upgrade to a fixed version: zeit next.js 9.3.2. Check the vendor advisory for mitigations.

References

• https://github.com/zeit/next.js/releases/tag/v9.3.2
• https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj
• https://github.com/zeit/next.js/releases/tag/v9.3.2
• https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj

Get alerted when CVE-2020-5284 or the next vulnerability affects your stack