PT-2024-9664 · Vercel+1 · Vercel+1
Tyage
·
Published
2024-10-28
·
Updated
2026-04-30
·
CVE-2024-51479
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Next.js versions prior to 14.2.15
Description
The issue is related to authorization bypass in Next.js applications when authorization is performed in middleware based on pathname. This allows attackers to bypass security checks for pages directly under the application's root directory. For example,
https://example.com/foo is affected, while https://example.com/ and https://example.com/foo/bar are not. The vulnerability affects millions of developers and has been automatically mitigated for applications hosted on Vercel, regardless of the Next.js version. There are no official workarounds for this vulnerability.Recommendations
For Next.js versions prior to 14.2.15, upgrade to version 14.2.15 or later to resolve the issue. If your Next.js application is hosted on Vercel, no action is required as the vulnerability has been automatically mitigated. As a temporary workaround, consider restricting access to sensitive pages or disabling middleware-based authorization until a patch is applied.
Exploit
Fix
Improper Authorization
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Next.Js
Vercel