GitHub Advisoryadvisory · npm

GHSA-x56p-c8cg-q435 Open Redirect in Next.js versions

MEDIUM Published 2020-10-08 Modified 2021-10-06 Official page ↗

Aliases: CVE-2020-15242
Ecosystem: npm
Packages: next
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Weaknesses: CWE-601
Reviewed: 2020-10-08

Affected packages

• npm next: >= 9.5.0, < 9.5.4 → fixed in 9.5.4

Description

Impact • Affected: Users of Next.js between 9.5.0 and 9.5.3 • Not affected: Deployments on Vercel (https://vercel.com) are not affected • Not affected: Deployments using `next export` We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. Patches https://github.com/vercel/next.js/releases/tag/v9.5.4 References https://github.com/vercel/next.js/releases/tag/v9.5.4

Related

Alias · CVE (1)

CVE-2020-15242 Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. vulnerability

Weakness · CWE (1)

CWE-601 URL Redirection to Untrusted Site weakness

References