Description
Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | next | >= 7.0.0, < 7.0.2 | 7.0.2 | GHSA-qw96-mm2g-c8m7 |
Medium · 6.1
CVE-2018-18282
EUVD-2018-0672GHSA-qw96-mm2g-c8m7
Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page
Published Oct 12, 2018 · Updated Sep 16, 2024 · Assigned by mitre