Next version 0.2.6 introduces notable dependency updates compared to its predecessor, version 0.2.5. The most significant changes lie in the updated versions of its core dependencies. Specifically, es5-ext advances from the 0.6.x range to the 0.7.x range, promising potential improvements and bug fixes in ECMAScript 5 extensions. Similarly, the deferred dependency jumps from 0.2.x to 0.4.x, indicating a potentially substantial overhaul in asynchronous programming capabilities. These updates are pivotal for developers relying on next for robust and modern Node.js extensions, offering possible performance enhancements and feature additions. While the devDependencies, namely tad, remain consistent, these core dependency upgrades suggest a focus on stability and leveraging the latest advancements in underlying libraries. For developers choosing between the two versions, the upgrade to 0.2.6 indicates a shift towards more recent and potentially more reliable versions of essential libraries. Carefully reviewing the changelogs for es5-ext (0.7.x) and deferred (0.4.x) would be beneficial before upgrading to understand the specific changes and impact on your project. Version 0.2.6 was released on January 21, 2012, four days after version 0.2.5 which was released on January 17, 2012.
All the vulnerabilities related to the version 0.2.6 of the package
Directory Traversal in Next.js
serverless
targetnext export
We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.
https://github.com/zeit/next.js/releases/tag/v9.3.2
https://github.com/zeit/next.js/releases/tag/v9.3.2
Next.js Race Condition to Cache Poisoning
Summary
We received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps
data instead of standard HTML.
Credit
Thank you to Allam Rachid (zhero) for the responsible disclosure. This research was rewarded as part of our bug bounty program.