vercel/next.js · Security
Next.js authorization bypass vulnerability
- GHSA ID
- GHSA-7gfc-8cq8-jh5f
- CVE ID
- CVE-2024-51479
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Impact
If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.
Patches
This issue was patched in Next.js 14.2.15 and later.
If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.
Workarounds
There are no official workarounds for this vulnerability.
Credits
We'd like to thank tyage (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.
CWEs
- CWE-285 · Improper Authorization
- CWE-863 · Incorrect Authorization
References
- https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f ↗
- https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b ↗
- https://nvd.nist.gov/vuln/detail/CVE-2024-51479 ↗
- https://github.com/vercel/next.js/releases/tag/v14.2.15 ↗
- https://github.com/advisories/GHSA-7gfc-8cq8-jh5f ↗