The React Framework
Published Node.js and peer-dependency requirements.
| Requirement | From9.3.1 on npm (opens in a new tab) | To9.3.2 on npm (opens in a new tab) |
|---|---|---|
Node.js | >=8.10.0 | >=10.13.0 |
26 Mar 2020 · Newest first
Last checked
Checking sources…
Showing 1 of 1 releases. Full release notes.
Signals highlight changes worth reviewing. They cannot determine whether your application is affected.
.nextThis does not affect files outside of the dist directory (.next).
In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory.
We recommend upgrading to the latest version of Next.js to improve the overall security of your application.
npm install next@latest --saveserverless targetnext exportnext startWe recommend everyone to upgrade regardless of whether you can reproduce the issue or not.
If you think sensitive code or data could have been exposed, you can filter logs of affected sites by ../ with a 200 response.
As Next.js has grown in popularity, it has received the attention of security researchers and auditors. We are thankful to Luca Carettoni from Doyensec for their investigation and discovery of the original bug and subsequent responsible disclosure.
We've landed a patch that ensures only known filesystem paths of .next/static are made available under /_next/static.
Regression tests for this attack were added to the security integration test suite.
remark link in blog-starter's README: #11177isStaging in with-env example: #11305Huge thanks to @chibicode, @ijjk, @timneutkens, @sebastianbenz, @zhe, @shaswatsaxena, @prateekbh, @vvo, @lfades, @bbortt, @aviaryan, @mgranados, @julianbenegas, @gregrickaby, @dulmandakh, @yosuke-furukawa, @tinymachine, @bgoerdt, @nicolasrouanne, @filipesmedeiros, @rishabhsaxena, and @queq1890 for helping!