CVE-2024-51479
Authorization bypass in Next.js
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Authorization bypass in Next.js
Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.
Reserved 2024-10-28 | Published 2024-12-17 | Updated 2024-12-17 | Assigner GitHub_MCWE-285: Improper Authorization
github.com/...ext.js/security/advisories/GHSA-7gfc-8cq8-jh5f
github.com/vercel/next.js/releases/tag/v14.2.15
Support options
