Next.js versions 0.2.0 and 0.2.1 represent incremental improvements to a Node.js extension library designed to enhance development workflows. Both versions share a core foundation, indicated by identical dependencies on es5-ext (version 0.6.x) and deferred (version 0.2.x), suggesting continued reliance on established utilities for ECMAScript 5 extensions and asynchronous programming. This indicates a stable base for developers already familiar with these underlying technologies.
The key distinction lies in the introduction of a tad (version 0.1.x) as a development dependency in version 0.2.1. While not a direct dependency impacting end-users, the presence of tad suggests an enhanced internal testing or debugging environment. For developers considering contributions or deeper engagement with the library's source code, this inclusion signals an investment in maintainability and code quality. This refinement is reinforced by the slightly later release date of version 0.2.1, indicative of a patch or minor improvement applied to the foundation, improving stability and reliability for those interested in adding functionalities. With identical core dependencies, developers can migrate smoothly between these minor versions, gaining the potential benefits of the refined testing and improved development workflow, while using a dependable library.
All the vulnerabilities related to the version 0.2.1 of the package
Directory Traversal in Next.js
serverless
targetnext export
We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.
https://github.com/zeit/next.js/releases/tag/v9.3.2
https://github.com/zeit/next.js/releases/tag/v9.3.2
Next.js Race Condition to Cache Poisoning
Summary
We received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps
data instead of standard HTML.
Credit
Thank you to Allam Rachid (zhero) for the responsible disclosure. This research was rewarded as part of our bug bounty program.