GitHub Advisoryadvisory · npm
GHSA-7gfc-8cq8-jh5f Next.js authorization bypass vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2024-51479
- Ecosystem
- npm
- Packages
- next
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-285, CWE-863
- Reviewed
- 2024-12-17
Affected packages
• npm next: >= 9.5.5, < 14.2.15 → fixed in 14.2.15
Description
Impact
If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.
Patches
This issue was patched in Next.js `14.2.15` and later.
If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.
Workarounds
There are no official workarounds for this vulnerability.
Credits
We'd like to thank tyage (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.
Related
Alias · CVE (1)
- CVE-2024-51479 Next.js is a React framework for building full-stack web applications. vulnerability
References
- https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f web
- https://nvd.nist.gov/vuln/detail/CVE-2024-51479 advisory
- https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b web
- https://github.com/vercel/next.js package
- https://github.com/vercel/next.js/releases/tag/v14.2.15 web