Link to the code that reproduces this issue
https://github.com/MTroian94/next-version-window
To Reproduce
- Build the application (pnpm run build)
- Start the production server (pnpm run start)
- Open the browser and visit the page
- Open the browser console
- window.next shows the actual version
Current vs. Expected behavior
Following the steps from the previous section, I expected to see the next version in window.next
Provide environment information
Operating System:
Platform: darwin
Arch: x64
Version: Darwin Kernel Version 22.6.0: Wed Jul 5 22:21:56 PDT 2023; root:xnu-8796.141.3~6/RELEASE_X86_64
Available memory (MB): 16384
Available CPU cores: 12
Binaries:
Node: 20.9.0
npm: 10.1.0
Yarn: 1.22.19
pnpm: 9.1.2
Relevant Packages:
next: 15.0.3-canary.9 // Latest available version is detected (15.0.3-canary.9).
eslint-config-next: N/A
react: 19.0.0-rc-66855b96-20241106
react-dom: 19.0.0-rc-66855b96-20241106
typescript: 5.3.3
Next.js Config:
output: N/A
Which area(s) are affected? (Select all that apply)
Not sure
Which stage(s) are affected? (Select all that apply)
next build (local)
Additional context
These discussions:
show how to hide the Next.js version by modifying the built code. Is it possible to hide the Next.js version using the configuration in the next.config.js file? Setting poweredByHeader to false is not enough.
This is still a potential security issue for apps using Next.js, as attackers can see which Next.js version is used and potentially find exploits for that particular version.
Thank you!
Link to the code that reproduces this issue
https://github.com/MTroian94/next-version-window
To Reproduce
Current vs. Expected behavior
Following the steps from the previous section, I expected to see the next version in
window.nextProvide environment information
Operating System: Platform: darwin Arch: x64 Version: Darwin Kernel Version 22.6.0: Wed Jul 5 22:21:56 PDT 2023; root:xnu-8796.141.3~6/RELEASE_X86_64 Available memory (MB): 16384 Available CPU cores: 12 Binaries: Node: 20.9.0 npm: 10.1.0 Yarn: 1.22.19 pnpm: 9.1.2 Relevant Packages: next: 15.0.3-canary.9 // Latest available version is detected (15.0.3-canary.9). eslint-config-next: N/A react: 19.0.0-rc-66855b96-20241106 react-dom: 19.0.0-rc-66855b96-20241106 typescript: 5.3.3 Next.js Config: output: N/AWhich area(s) are affected? (Select all that apply)
Not sure
Which stage(s) are affected? (Select all that apply)
next build (local)
Additional context
These discussions:
show how to hide the Next.js version by modifying the built code. Is it possible to hide the Next.js version using the configuration in the
next.config.jsfile? SettingpoweredByHeaderto false is not enough.This is still a potential security issue for apps using Next.js, as attackers can see which Next.js version is used and potentially find exploits for that particular version.
Thank you!