https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T20:34:19.609301+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-22200 cnvd-2020-22200 2026-10-05T20:34:19.677773+00:00 cnvd-2020-22200 https://cve.radiocsirt.org/vuln/euvd-2026-36490 EUVD-2026-36490 2026-10-05T20:34:19.677812+00:00 EUVD-2026-36490 https://cve.radiocsirt.org/vuln/fkie_cve-2020-5284 fkie_cve-2020-5284 2026-10-05T20:34:19.677826+00:00

Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.

 https://cve.radiocsirt.org/vuln/ghsa-fq77-7p7r-83rj GHSA-fq77-7p7r-83rj — Directory Traversal in Next.js 2026-10-05T20:34:19.677855+00:00

Affected: npm: next

### Impact

- **Not affected**: Deployments on ZEIT Now v2 ([https://zeit.co](https://zeit.co/)) are not affected - **Not affected**: Deployments using the `serverless` target - **Not affected**: Deployments using `next export` - **Affected**: Users of Next.js below 9.3.2

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

### Patches

https://github.com/zeit/next.js/releases/tag/v9.3.2

### References

https://github.com/zeit/next.js/releases/tag/v9.3.2

 https://cve.radiocsirt.org/vuln/gsd-2020-5284 gsd-2020-5284 2026-10-05T20:34:19.677885+00:00 gsd-2020-5284