Read the docs
TI-2018-04542 Aliases CVE-2018-6184GHSA-m34x-wgrh-g897

ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.

Priority MEDIUM 44CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.

Why it matters now

EPSS 0.0906 95th percentileScored 2026-11-07
Fix Fixed next (npm): 4.2.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—next (npm)1.0.0 to before 4.2.34.2.3Patch availableGHSA-m34x-wgrh-g897
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • next (npm) Vendor— Affected 1.0.0 to before 4.2.3 Fixed in 4.2.3 Patch available GHSA-m34x-wgrh-g897

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:zeit:next.js:4.0.0:*:*:*:*:*:*:*4.0.0Vulnerablezeit
cpe:2.3:a:zeit:next.js:4.0.1:*:*:*:*:*:*:*4.0.1Vulnerablezeit
cpe:2.3:a:zeit:next.js:4.0.2:*:*:*:*:*:*:*4.0.2Vulnerablezeit
cpe:2.3:a:zeit:next.js:4.0.3:*:*:*:*:*:*:*4.0.3Vulnerablezeit
cpe:2.3:a:zeit:next.js:4.0.4:*:*:*:*:*:*:*4.0.4Vulnerablezeit
cpe:2.3:a:zeit:next.js:4.0.5:*:*:*:*:*:*:*4.0.5Vulnerablezeit
cpe:2.3:a:zeit:next.js:4.1.0:*:*:*:*:*:*:*4.1.0Vulnerablezeit
cpe:2.3:a:zeit:next.js:4.1.1:*:*:*:*:*:*:*4.1.1Vulnerablezeit
cpe:2.3:a:zeit:next.js:4.1.2:*:*:*:*:*:*:*4.1.2Vulnerablezeit
cpe:2.3:a:zeit:next.js:4.1.3:*:*:*:*:*:*:*4.1.3Vulnerablezeit
  • cpe:2.3:a:zeit:next.js:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·zeit
  • cpe:2.3:a:zeit:next.js:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·zeit
  • cpe:2.3:a:zeit:next.js:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·zeit
  • cpe:2.3:a:zeit:next.js:4.0.3:*:*:*:*:*:*:* Versions 4.0.3 Vulnerable ·zeit
  • cpe:2.3:a:zeit:next.js:4.0.4:*:*:*:*:*:*:* Versions 4.0.4 Vulnerable ·zeit
  • cpe:2.3:a:zeit:next.js:4.0.5:*:*:*:*:*:*:* Versions 4.0.5 Vulnerable ·zeit
  • cpe:2.3:a:zeit:next.js:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·zeit
  • cpe:2.3:a:zeit:next.js:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·zeit
  • cpe:2.3:a:zeit:next.js:4.1.2:*:*:*:*:*:*:* Versions 4.1.2 Vulnerable ·zeit
  • cpe:2.3:a:zeit:next.js:4.1.3:*:*:*:*:*:*:* Versions 4.1.3 Vulnerable ·zeit
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zeit:next.js:4.1.4:*:*:*:*:*:*:*4.1.4Vulnerablezeit
cpe:2.3:a:zeit:next.js:4.1.4:canary_1:*:*:*:*:*:*4.1.4 canary_1Vulnerablezeit
cpe:2.3:a:zeit:next.js:4.1.4:canary_2:*:*:*:*:*:*4.1.4 canary_2Vulnerablezeit
cpe:2.3:a:zeit:next.js:4.2.0:*:*:*:*:*:*:*4.2.0Vulnerablezeit
cpe:2.3:a:zeit:next.js:4.2.0:canary_1:*:*:*:*:*:*4.2.0 canary_1Vulnerablezeit
cpe:2.3:a:zeit:next.js:4.2.1:*:*:*:*:*:*:*4.2.1Vulnerablezeit
cpe:2.3:a:zeit:next.js:4.2.2:*:*:*:*:*:*:*4.2.2Vulnerablezeit
  • cpe:2.3:a:zeit:next.js:4.1.4:*:*:*:*:*:*:* Versions 4.1.4 Vulnerable ·zeit
  • cpe:2.3:a:zeit:next.js:4.1.4:canary_1:*:*:*:*:*:* Versions 4.1.4 canary_1 Vulnerable ·zeit
  • cpe:2.3:a:zeit:next.js:4.1.4:canary_2:*:*:*:*:*:* Versions 4.1.4 canary_2 Vulnerable ·zeit
  • cpe:2.3:a:zeit:next.js:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·zeit
  • cpe:2.3:a:zeit:next.js:4.2.0:canary_1:*:*:*:*:*:* Versions 4.2.0 canary_1 Vulnerable ·zeit
  • cpe:2.3:a:zeit:next.js:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·zeit
  • cpe:2.3:a:zeit:next.js:4.2.2:*:*:*:*:*:*:* Versions 4.2.2 Vulnerable ·zeit

Remediation

  • Fix · GHSA-m34x-wgrh-g897 next (npm) Fixed in 4.2.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-6184
  2. 2026-10-03 Alias added: GHSA-m34x-wgrh-g897

References

Advisory 3

Other 2

  • TI-2020-04340 Directory Traversal in Next.js versions below 9.3.2 CVSS 3.1MEDIUM 4.4
  • TI-2017-12422 ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request… CVSS 3.0HIGH 7.5
  • TI-2018-12917 Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page. CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences