Nextjs v2.4.1 LFI

Next.js is a server-rendered React framework with a simple approach.Next.js versions prior to 2.4.1 include a directory traversal bug. The / next and /static request namespaces are affected by this problem. An attacker can create a request that allows them to access potentially sensitive data in your filesystem.

Mitigation / Precaution

In order to patch this vulnerability, we suggest you update Nextjs to the latest version.

Written by

Prathap

Co-founder, Director

Prathap has around 20 years of experience and has worked on various projects in leading companies like Hitachi, Toshiba, Schneider Electric, ABB, Panasonic, and MicroFuzzy. His expertise lies in architecting, designing, and developing secure projects covering various aspects of software development, processes, and methodology.