---
category: minorAnalysis
---
* `router.push` and `router.replace` in `Next.js` are now considered as XSS sink.