GHSA-7gfc-8cq8-jh5f

Source

https://github.com/advisories/GHSA-7gfc-8cq8-jh5f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-7gfc-8cq8-jh5f/GHSA-7gfc-8cq8-jh5f.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7gfc-8cq8-jh5f

Aliases

CVE-2024-51479

Published

2024-12-17T15:09:06Z

Modified

2024-12-19T15:04:21Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Next.js authorization bypass vulnerability

Details

Impact

If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.

Patches

This issue was patched in Next.js 14.2.15 and later.

If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

We'd like to thank tyage (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.

Database specific

{
    "nvd_published_at": "2024-12-17T19:15:06Z",
    "cwe_ids": [
        "CWE-285"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-17T15:09:06Z"
}

References

Affected packages

npm / next

Package

Name: next; View open source insights on deps.dev
Purl: pkg:npm/next

Affected ranges

Type: SEMVER
Events: Introduced

9.5.5

Fixed

14.2.15