Skip to content

[Feature] be able to hide the next version #72471

Description

@MTroian94

Link to the code that reproduces this issue

https://github.com/MTroian94/next-version-window

To Reproduce

  1. Build the application (pnpm run build)
  2. Start the production server (pnpm run start)
  3. Open the browser and visit the page
  4. Open the browser console
  5. window.next shows the actual version

Current vs. Expected behavior

Following the steps from the previous section, I expected to see the next version in window.next

Provide environment information

Operating System:
  Platform: darwin
  Arch: x64
  Version: Darwin Kernel Version 22.6.0: Wed Jul  5 22:21:56 PDT 2023; root:xnu-8796.141.3~6/RELEASE_X86_64
  Available memory (MB): 16384
  Available CPU cores: 12
Binaries:
  Node: 20.9.0
  npm: 10.1.0
  Yarn: 1.22.19
  pnpm: 9.1.2
Relevant Packages:
  next: 15.0.3-canary.9 // Latest available version is detected (15.0.3-canary.9).
  eslint-config-next: N/A
  react: 19.0.0-rc-66855b96-20241106
  react-dom: 19.0.0-rc-66855b96-20241106
  typescript: 5.3.3
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Not sure

Which stage(s) are affected? (Select all that apply)

next build (local)

Additional context

These discussions:

show how to hide the Next.js version by modifying the built code. Is it possible to hide the Next.js version using the configuration in the next.config.js file? Setting poweredByHeader to false is not enough.

This is still a potential security issue for apps using Next.js, as attackers can see which Next.js version is used and potentially find exploits for that particular version.

Thank you!

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugIssue was opened via the bug report template.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions