Packages / next / Security

HighVulnerabilityGHSA-7gfc-8cq8-jh5fCVE-2024-51479Published 17 Dec 2024

Next.js authorization bypass vulnerability

Affected releases · next

  • 14.x14.0.0 – 14.2.14Fixed in 14.2.15
  • 13.x and older9.5.5 – 13.5.11No fix, no longer updated

On 14.x, the newest line:

npm install next@14.2.15
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

14.x

  1. Affected

    14.0.0 – 14.2.14

    25 releases

  2. Fixed

    14.2.15 – 14.2.35

    21 releases

13.x

  1. Affected

    13.0.0 – 13.5.11

    56 releases

12.x

  1. Affected

    12.0.0 – 12.3.7

    33 releases

11.x

  1. Affected

    11.0.0 – 11.1.4

    7 releases

10.x

  1. Affected

    10.0.0 – 10.2.3

    18 releases

9.x

  1. Not affected

    9.0.0 – 9.5.4

    37 releases

  2. Affected

    9.5.5

    1 release

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.

Patches

This issue was patched in Next.js 14.2.15 and later.

If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

We'd like to thank tyage (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.