Next.js: Unable to obtain statusCode on a client-side rendered error page in next 7.0.2

Created on 12 Oct 2018 · 4Comments · Source: vercel/next.js

Bug report

Describe the bug

Upgrading next to 7.0.2 makes it impossible to render a 404 page on the client when a person loads a server-rendered 404 page, then navigates to some other page and finally goes back to a 404 page using browser navigation. This applies to production environment only (in dev, 404 throws anyway).

To Reproduce

MWE: https://github.com/kachkaev/next.js-5437

git clone [email protected]:kachkaev/next.js-5437.git
cd next-issue-xxx
yarn
yarn build && yarn start

Go to http://localhost:3000/asdf (non-existing page). You will see Error: 404 (it is server-rendered).
Click on _main page_, see URL changed to http://localhost:3000/.
Press _back_ in your browser to return to http://localhost:3000/asdf. You will see Error: 404 again, now rendered on the client. So far so good – it's [email protected]. Here's where custom status code is coming from in pages/_error.js:
```
  static getInitialProps({ res, err }) {
    const statusCode = res ? res.statusCode : err ? err.statusCode : null;
    return { statusCode };
  }
```
(res is used during SSR and err is used during the client-side rendering)

yarn add [email protected]
yarn build && yarn start

Repeat steps 2-4. In step 4, you will see Error: unknown instead of Error: 404. This means that the page will look like if the web app crashed badly. The cause of this behaviour is that err is now undefined in getInitialProps, unlike in 7.0.1.

System information

OS: macOS
Browser (if applies) Google Chrome
Version of Next.js: 7.0.2

bug

Source

kachkaev

All 4 comments

Given that this issue is likely to be related with a security fix in 7.0.2, I'd like to add that a CVE link in release notes does not take a reader to a specific CVE as expected. I could not find a description of the recent vulnerability via their search as well.

__UPD:__ CVE is finally there: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18282

kachkaev on 12 Oct 2018

The CVE is on the way. It's a manual process on their side and we'll update the link soon.