Next Js
CVE-2021-39178
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1Blast Radius
ecosystem impact- 6 npm packages depend on next (5 direct, 1 indirect)
Ecosystem-wide dependent count for version 10.0.0.
DescriptionNVD
Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an instance to be affected by the vulnerability, the next.config.js file must have images.domains array assigned and the image host assigned in images.domains must allow user-provided SVG. If the next.config.js file has images.loader assigned to something other than default or the instance is deployed on Vercel, the instance is not affected by the vulnerability. The vulnerability is patched in Next.js version 11.1.1.
AnalysisAI
Next.js is a React framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an instance to be affected by the vulnerability, the next.config.js file must have images.domains array assigned and the image host assigned in images.domains must allow user-provided SVG. If the next.config.js file has images.loader assigned to something other than default or the instance is deployed on Vercel, the instance is not affected by the vulnerability. The vulnerability is patched in Next.js version 11.1.1. Affected products include: Vercel Next.Js. Version information: version 11.1.1..
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5)
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached
ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace. Rated high severity (CVSS 7.5),
Next.js versions before 9.3.2 have a directory traversal vulnerability. Rated medium severity (CVSS 4.3), this vulnerabi
Next.js is a React framework for building full-stack web applications. Rated high severity (CVSS 7.5), this vulnerabilit
Next.js is a React Framework for the Web. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
Next.js is a React framework for building full-stack web applications. Rated high severity (CVSS 7.5), this vulnerabilit
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5)
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
Next.js is an open source website development framework to be used with the React library. Rated medium severity (CVSS 6
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today