Packages / next / Security

ModerateVulnerabilityGHSA-x56p-c8cg-q435CVE-2020-15242Published 8 Oct 2020

Open Redirect in Next.js versions

Affected releases · next

  • 9.x9.5.0 – 9.5.3Fixed in 9.5.4

On 9.x, the newest line:

npm install next@9.5.4
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

9.x

  1. Not affected

    9.0.0 – 9.4.4

    32 releases

  2. Affected

    9.5.0 – 9.5.3

    4 releases

  3. Fixed

    9.5.4 – 9.5.5

    2 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

  • Affected: Users of Next.js between 9.5.0 and 9.5.3

  • Not affected: Deployments on Vercel (vercel.com) are not affected

  • Not affected: Deployments using next export

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

Patches

github.com/vercel/next.js/releases/tag/v9.5.4

References

github.com/vercel/next.js/releases/tag/v9.5.4