CVE-2017-16877

CVE-2017-16877 describes a directory traversal vulnerability in ZEIT Next.js versions prior to 2.4.1. This flaw allows attackers to access sensitive information by manipulating requests under the /_next and /static namespaces. With a CVSS score of 7.5 (High), it represents a significant risk due to its network-based attack vector and low attack complexity, potentially leading to critical information disclosure. While not listed in CISA's KEV catalog, exploit intelligence indicates the existence of Nuclei templates for local file inclusion, suggesting readily available exploit code. Despite its high FAUCET Risk Score and EPSS percentile, there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.