Source Maps Exposed in Production
JavaScript source map files (.map) are publicly accessible in production, revealing the complete original source code including comments, variable names, and internal logic.
How It Works
Source maps are files that map minified/bundled JavaScript back to the original source code. When left accessible in production, anyone can download them and reconstruct the entire codebase. This reveals business logic, API endpoints, validation rules, authentication flows, hardcoded values, internal comments, and code structure. Attackers use this information to find vulnerabilities faster by reading the actual source instead of reverse-engineering minified code. Next.js generates source maps by default in production builds.
// next.config.js — source maps enabled (default)
module.exports = {
productionBrowserSourceMaps: true,
// .map files are now publicly accessible
// e.g., /_next/static/chunks/pages/admin-a1b2c3.js.map
};// next.config.js — disable public source maps
module.exports = {
productionBrowserSourceMaps: false,
// Upload source maps to error tracking only
sentry: {
hideSourceMaps: true,
},
};Real-World Example
In 2021, researchers found that several major websites including e-commerce platforms had source maps exposed, revealing complete React component trees, API integration code, and admin panel logic. This gave attackers a roadmap to find and exploit vulnerabilities.
How to Prevent It
- Set productionBrowserSourceMaps: false in next.config.js
- Upload source maps to Sentry or similar tools privately, not publicly
- Add *.map to your CDN's deny rules or Content-Security-Policy
- Audit deployed files to ensure no .map files are publicly accessible
Affected Technologies
Data Hogo detects this vulnerability automatically.
Scan Your Repo FreeRelated Vulnerabilities
dangerouslySetInnerHTML Without Sanitization
highUsing React's dangerouslySetInnerHTML with unsanitized user input allows attackers to inject malicious scripts that execute in other users' browsers.
Authentication Tokens in localStorage
highStoring JWT tokens, session tokens, or API keys in localStorage makes them accessible to any JavaScript running on the page, including XSS payloads.
__NEXT_DATA__ Secrets Exposure
highNext.js page props passed through getServerSideProps or getStaticProps leak sensitive data like API keys, database URLs, or internal configuration via the __NEXT_DATA__ script tag.
Open CORS in Next.js API Routes
mediumNext.js API routes configured with Access-Control-Allow-Origin: * allow any website to make authenticated cross-origin requests, enabling CSRF-like attacks.