CVE-2018-6184: Directory Traversal Vulnerability in Next.js
Summary
CVE-2018-6184: Directory traversal vulnerability in Next.js. Affects next versions >= 1.0.0, < 4.2.3. Fixed in 4.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Next.js is a popular framework for building server-side rendered React applications. It provides a streamlined development experience and offers features like automatic code splitting, server-side rendering, and static site generation. The vulnerability in question affects Next.js versions 4.0.0 to 4.2.2. It allows an attacker to perform directory traversal attacks by exploiting the /_next request namespace.
Vulnerability Detail
The directory traversal vulnerability in Next.js allows an attacker to access files outside of the intended directory. By manipulating the request URL, an attacker can bypass access restrictions and retrieve sensitive information or execute arbitrary code. This can lead to unauthorized access, data leakage, and potential remote code execution.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.2.3
This is the first release that contains the fix.
npm install next@4.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by adding custom request handling logic to prevent directory traversal. This can be achieved by validating and sanitizing user input, ensuring that requested files are within the intended directory structure. Here's an example of how this can be done in Next.js:
// Custom request handler
const handleRequest = (req, res) => {
const filePath = sanitizeFilePath(req.url);
if (isWithinAllowedDirectory(filePath)) {
// Process the request
} else {
// Handle invalid request
}
};
// Register the custom request handler
server.get('/_next/*', handleRequest);
Conclusion
The directory traversal vulnerability in Next.js can have serious security implications. It is crucial to upgrade to the latest version (4.2.3 or later) or implement the provided workaround to mitigate the risk. Regularly monitoring for vulnerabilities using tools like Vulert can help ensure the security of your application. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for next →
FAQ
The vulnerability allows an attacker to access files outside of the intended directory, potentially leading to unauthorized access, data leakage, and remote code execution.
Next.js versions 4.0.0 to 4.2.2 are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to apply the recommended fixes to prevent any potential attacks.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/01/GHSA-m34x-wgrh-g897/GHSA-m34x-wgrh-g897.json
Related vulnerabilities
Recent vulnerabilities recorded for next.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
