Read the docs
TI-2020-04340 Aliases CVE-2020-5284GHSA-fq77-7p7r-83rj

Directory Traversal in Next.js versions below 9.3.2

Priority MEDIUM 50CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.

Why it matters now

EPSS 0.44776 98th percentileScored 2026-11-07
Fix Fixed next.js (zeit): 9.3.2next (npm): 9.3.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
zeitnext.jsbefore 9.3.29.3.2Patch availableCNA
—next (npm)0.9.9 to before 9.3.29.3.2Patch availableGHSA-fq77-7p7r-83rj
  • next.js Vendorzeit Affected before 9.3.2 Fixed in 9.3.2 Patch available CNA
  • next (npm) Vendor— Affected 0.9.9 to before 9.3.2 Fixed in 9.3.2 Patch available GHSA-fq77-7p7r-83rj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*before 9.3.2Vulnerablezeit
  • cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:* Versions before 9.3.2 Vulnerable ·zeit

Remediation

  • Fix · CNA next.js (zeit) Fixed in 9.3.2
  • Fix · GHSA-fq77-7p7r-83rj next (npm) Fixed in 9.3.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5284
  2. 2026-10-03 Alias added: GHSA-fq77-7p7r-83rj

References

Advisory 2

Other 2

  • TI-2017-12422 ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request… CVSS 3.0HIGH 7.5
  • TI-2018-04542 ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace. CVSS 3.0HIGH 7.5
  • TI-2018-12917 Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page. CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences