Skip to content
Fencer Vulns
medium 4.4

CVE-2020-5284 json

Directory Traversal in Next.js versions below 9.3.2

published 2020-03-30 6 y ago modified 2026-09-10 1 mo ago also EUVD-2020-0342 , GHSA-fq77-7p7r-83rj

cvss
4.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
44.8%
EPSS 44.8% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known, plus a Nuclei check

Summary

Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.

Patch / fix

  • npm next 9.3.2
  • zeit next.js 9.3.2

Exploit prediction

44.78% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CNA 3.1 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
GitHub 3.1 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected packages

ecosystem package affected fixed in
npm next
>=0.9.9, <9.3.2
9.3.2

Affected products

  • zeit next.js

Classification

Weakness
  • CWE-23 Relative Path Traversal
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of vercel/next.js published their own advisory on GitHub. Reviewed sources take precedence over it.