Skip to content

v9.3.2
Compare
Choose a tag to compare
@timneutkens timneutkens released this 26 Mar 19:13
· 15276 commits to canary since this release
v9.3.2
ee00813

This upgrade is completely backwards compatible and recommended for all users on versions below 9.3.2. For future security related communications of our OSS projects, please join this mailing list.

Next.js has just been audited by one of the top security firms in the world.

They found that attackers could craft special requests to access files in the dist directory (.next).

This does not affect files outside of the dist directory (.next).

In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory.

We recommend upgrading to the latest version of Next.js to improve the overall security of your application.

How to Upgrade

  • We have released patch versions for both the stable and canary channels of Next.js.
  • To upgrade run npm install next@latest --save

Impact

  • Not affected: Deployments on ZEIT Now v2 (https://zeit.co) are not affected
  • Not affected: Deployments using the serverless target
  • Not affected: Deployments using next export
  • Affected: Users of Next.js below 9.3.2 that use next start

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

How to Assess Impact

If you think sensitive code or data could have been exposed, you can filter logs of affected sites by ../ with a 200 response.

What is Being Done

As Next.js has grown in popularity, it has received the attention of security researchers and auditors. We are thankful to Luca Carettoni from Doyensec for their investigation and discovery of the original bug and subsequent responsible disclosure.

We've landed a patch that ensures only known filesystem paths of .next/static are made available under /_next/static.
Regression tests for this attack were added to the security integration test suite.

  • We have notified known Next.js users in advance of this publication.
  • A public CVE was issued.
  • If you want to stay on top of our security related news impacting Next.js or other ZEIT projects, please join this mailing list.
  • We encourage responsible disclosure of future issues. Please email us at security@zeit.co. We are actively monitoring this mailbox.

Patches

  • Add Numeric Separator Support for TypeScript: #11308
  • Update CLI custom config documentation link: #11152
  • Add error when attempting to export GSSP page: #11154
  • Update blog-starter example: #11071
  • Add CSS file to build output: #11145
  • Update <dir> reference in help text: 5274535
  • Clean up examples directory: #11169
  • Remove react-ssr-prepass alias as it's not longer needed: #11170
  • Upgrade @ampproject/toolbox-optimizer to 2.0.1: #11168
  • Add section on reading files: #11084
  • [Examples] fix remark link in blog-starter's README: #11177
  • Updated with-typescript example to SSG: #11081
  • Add CMS example for Sanity: #10907
  • Group CSS files in shared build output separate from JS files: #11184
  • Updating min nodejs requirement: #11181
  • Docs(ssr): req is an IncomingMessage instance, not HttpRequest: #11194
  • Add support for baseUrl option in tsconfig and jsconfig: #11203
  • [Example] with-passport: #10529
  • CMS TakeShape Example: #11038
  • Ensure hybrid AMP works correctly with SSG: #11205
  • Update mocha example with yml configuration.: #11214
  • Fix with-firebase-cloud-messaging example setup code: #10686
  • Update wording of new data fetching methods recommendation: #11221
  • Updated Api Routes Middleware example to use getServerSideProps: #11128
  • With Firebase Client-Side example: #11053
  • Docs(example): Load basic-css example on codesandbox: #11227
  • Remove mkdirp, bump fs-extra to 9.0.0: #11251
  • Add support for paths in tsconfig.json and jsconfig.json: #11293
  • Add test for single alias: #11296
  • Update GIP docs: #11303
  • Add custom amp optimizer and skip validation mode: #10705
  • Update handling for ENOENT from GSSP methods: #11302
  • Docs: clarify how to customize next/babel presets: #11316
  • Fix assignment of props in WithApollo.getInitialProps: #11236
  • Fix: typo in isStaging in with-env example: #11305
  • Skip paths that are routed to a .d.ts file: #11322
  • Upgrade loader-utils: #11324
  • Fix warning for API routes with next export: #11330
  • Make sure to copy AMP SSG files during export: #11331
  • Just a small typo I think, right?: #11344
  • [docs] Mention our channels: #11336
  • Use records to init store: #11343
  • Update data-fetching.md: 074c60e
  • Fix preview-mode docs/examples typo: #11345
  • Update to prevent re-using workers for getStaticPaths in dev mode: #11347

Credits

Huge thanks to @chibicode, @ijjk, @timneutkens, @sebastianbenz, @zhe, @shaswatsaxena, @prateekbh, @vvo, @lfades, @bbortt, @aviaryan, @mgranados, @julianbenegas, @gregrickaby, @dulmandakh, @yosuke-furukawa, @tinymachine, @bgoerdt, @nicolasrouanne, @filipesmedeiros, @rishabhsaxena, and @queq1890 for helping!

Assets 2