Next.js version 0.4.1 represents a minor update over version 0.4.0, primarily focusing on dependency enhancements and development tooling improvements. Both versions are described as providing Node.js extensions, though marked as deprecated implying users should seek alternatives.
A key difference lies in the updated dependencies. Version 0.4.1 utilizes more recent, though still relatively old, versions of es5-ext (0.10.11 vs 0.10.2), deferred (0.7.5 vs 0.7.x), and memoizee (0.3.9 vs 0.3.x). This suggests bug fixes and potentially performance optimizations within those core dependencies. Developers should review the changelogs of these individual libraries to fully understand the implications of these updates, although given the deprecation status, this might not be the best use of their time.
The later version also includes updated development dependencies, moving to newer versions of tad, xlint, and introducing xlint-jslint-medikoo. This points towards enhanced code quality checks and testing capabilities during development.
The release dates indicate a significant gap between the versions, with 0.4.0 released in April 2014 and 0.4.1 in February 2016. Given that these versions are quite old and deprecated, developers should strongly consider migration to more modern and actively supported libraries. Otherwise, if forced to use these, version 0.4.1 is preferable due to the dependency updates.
All the vulnerabilities related to the version 0.4.1 of the package
Directory Traversal in Next.js
serverless targetnext exportWe recommend everyone to upgrade regardless of whether you can reproduce the issue or not.
https://github.com/zeit/next.js/releases/tag/v9.3.2
https://github.com/zeit/next.js/releases/tag/v9.3.2
Next.js Race Condition to Cache Poisoning
Summary
We received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps data instead of standard HTML.
Credit
Thank you to Allam Rachid (zhero) for the responsible disclosure. This research was rewarded as part of our bug bounty program.