Packages / next / Security

ModerateVulnerabilityGHSA-vxf5-wxwp-m7g9CVE-2021-37699Published 12 Aug 2021

Open Redirect in Next.js

Affected releases · next

  • 11.x11.0.0 – 11.0.1Fixed in 11.1.0
  • 10.x and older0.9.9 – 10.2.3No fix, no longer updated

On 11.x, the newest line:

npm install next@11.1.0
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

11.x

  1. Affected

    11.0.0 – 11.0.1

    2 releases

  2. Fixed

    11.1.0 – 11.1.4

    5 releases

10.x

  1. Affected

    10.0.0 – 10.2.3

    18 releases

9.x

  1. Affected

    9.0.0 – 9.5.5

    38 releases

8.x

  1. Affected

    8.0.0 – 8.1.0

    6 releases

7.x

  1. Affected

    7.0.0 – 7.0.3

    4 releases

6.x

  1. Affected

    6.0.0 – 6.1.2

    7 releases

5.x

  1. Affected

    5.0.0 – 5.1.0

    2 releases

4.x

  1. Affected

    4.0.0 – 4.2.3

    15 releases

3.x

  1. Affected

    3.0.1 – 3.2.3

    11 releases

2.x

  1. Affected

    2.0.0 – 2.4.9

    17 releases

1.x

  1. Affected

    1.0.0 – 1.2.3

    10 releases

0.x

  1. Not affected

    0.1.0 – 0.4.1

    23 releases

  2. Affected

    0.9.9 – 0.9.11

    3 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated, allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although it can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain.

Impact

  • Affected: Users of Next.js between 10.0.5 and 10.2.0

  • Affected: Users of Next.js between 11.0.0 and 11.0.1 using pages/_error.js without getInitialProps

  • Affected: Users of Next.js between 11.0.0 and 11.0.1 using pages/_error.js and next export

  • Not affected: Deployments on Vercel (vercel.com) are not affected

  • Not affected: Deployments with pages/404.js

  • Note that versions prior to 0.9.9 package next npm package hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.

We recommend upgrading to the latest version of Next.js to improve the overall security of your application.

Patches

github.com/vercel/next.js/releases/tag/v11.1.0