Unable to obtain statusCode on a client-side rendered error page in next 7.0.2

[kachkaev]

Bug report

Describe the bug

Upgrading next to 7.0.2 makes it impossible to render a 404 page on the client when a person loads a server-rendered 404 page, then navigates to some other page and finally goes back to a 404 page using browser navigation. This applies to production environment only (in dev, 404 throws anyway).

To Reproduce

MWE: https://github.com/kachkaev/next.js-5437

1. git clone git@github.com:kachkaev/next.js-5437.git
   cd next-issue-xxx
   yarn
   yarn build && yarn start
   

2. Go to http://localhost:3000/asdf (non-existing page). You will see Error: 404 (it is server-rendered).

3. Click on main page, see URL changed to http://localhost:3000/.

4. Press back in your browser to return to http://localhost:3000/asdf. You will see Error: 404 again, now rendered on the client. So far so good – it's next@7.0.1. Here's where custom status code is coming from in pages/_error.js:

     static getInitialProps({ res, err }) {
       const statusCode = res ? res.statusCode : err ? err.statusCode : null;
       return { statusCode };
     }

   (res is used during SSR and err is used during the client-side rendering)

5.  yarn add next@7.0.2
    yarn build && yarn start

6. Repeat steps 2-4. In step 4, you will see Error: unknown instead of Error: 404. This means that the page will look like if the web app crashed badly. The cause of this behaviour is that err is now undefined in getInitialProps, unlike in 7.0.1.

System information

• OS: macOS
• Browser (if applies) Google Chrome
• Version of Next.js: 7.0.2

[kachkaev]

Given that this issue is likely to be related with a security fix in 7.0.2, I'd like to add that a CVE link in release notes does not take a reader to a specific CVE as expected. I could not find a description of the recent vulnerability via their search as well.

UPD: CVE is finally there: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18282

[timneutkens]

The CVE is on the way. It's a manual process on their side and we'll update the link soon.

[kachkaev]

Is this being fixed in Next.js 8 as a result of the refactoring? Just curious 😉

[timneutkens]

@kachkaev I'm not going to block v8 on this, but definitely having someone look into it ASAP 🙏 Thanks for the ping!