CVE-2018-18282: Cross-Site Scripting (XSS) Vulnerability in Next.js
Summary
CVE-2018-18282: Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page. Affects next versions >= 7.0.0, < 7.0.2. Fixed in 7.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is a popular framework for building server-side rendered React applications. It provides a simple and intuitive way to create dynamic web pages with React components. The vulnerability in Next.js version 7.0.0 and 7.0.1 allows for cross-site scripting (XSS) attacks through the 404 or 500 error pages. This means that an attacker can inject malicious code into the error page, which will be executed by the victim's browser when they encounter a 404 or 500 error.
Vulnerability Detail
The XSS vulnerability in Next.js arises from improper input sanitization on the 404 or 500 error pages. When an error occurs, Next.js renders the corresponding error page and includes any user-supplied data without proper validation or encoding. This allows an attacker to inject arbitrary JavaScript code into the error page, which will be executed in the context of the victim's browser. The impact of this vulnerability can range from stealing sensitive user information to performing actions on behalf of the victim.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.2
This is the first release that contains the fix.
npm install next@7.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Next.js is not immediately feasible, developers can implement a workaround by manually sanitizing and encoding any user-supplied data before rendering the error pages. This can be done using libraries like DOMPurify or by implementing custom sanitization functions. Here's an example of how to use DOMPurify to sanitize user input:
import DOMPurify from 'dompurify';
const sanitizedData = DOMPurify.sanitize(userInput);
Conclusion
The XSS vulnerability in Next.js version 7.0.0 and 7.0.1 can allow attackers to inject malicious code into the error pages, leading to potential security breaches and unauthorized actions. It is crucial for developers to upgrade to Next.js version 7.0.2 or later to mitigate this vulnerability. If immediate upgrading is not possible, implementing manual sanitization and encoding of user-supplied data can serve as a temporary workaround. For further support and guidance on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for next →
FAQ
The vulnerability allows an attacker to inject malicious code into the error pages of Next.js applications. This can lead to various consequences, including stealing sensitive user information, performing actions on behalf of the victim, or spreading malware.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
Yes, the vulnerability has been fixed in Next.js version 7.0.2. Developers should upgrade their Next.js dependency to this version or later to mitigate the risk of XSS attacks.
If upgrading to the latest version of Next.js is not immediately feasible, developers can manually sanitize and encode user-supplied data before rendering the error pages. Libraries like DOMPurify can be used for this purpose.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in fixing the vulnerability in your Next.js application.
Related vulnerabilities
Recent vulnerabilities recorded for next.
