---
id: 6566
title: "Exploiting Web3's Hidden Attack Surface: Universal XSS on Netlify's Next.js Library"
source_domain: samcurry.net
source_url: "https://samcurry.net/universal-xss-on-netlifys-next-js-library"
published_at: "2022-09-21T00:00:00Z"
tags: ["web3", "xss", "nextjs", "ssrf", "netlify", "netlify-ipx"]
phying_url: "https://phying.com/item/6566"
lang: en
---

# Exploiting Web3's Hidden Attack Surface: Universal XSS on Netlify's Next.js Library

## Summary

Universal XSS in Netlify's netlify-ipx library gave persistent cross-site scripting and full-response SSRF on any Next.js site—impacting PancakeSwap, Gemini, Docusign and more; fixed in two days.

## Intelligence Metadata

- **Sources:** samcurry.net
- **Published:** 2022-09-21T00:00:00Z
- **Original:** https://samcurry.net/universal-xss-on-netlifys-next-js-library
- **Phying News:** https://phying.com/item/6566