CVE-2024-51479: Authorization bypass in Next.js
Impact If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.
Patches This issue was patched in Next.js 14.2.15 and later.
If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.
Workarounds There are no official workarounds for this vulnerability.
Credits We'd like to thank tyage (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.
Other sources
Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: [Not affected] https://example.com/ [Affected] https://example.com/foo [Not affected] https://example.com/foo/bar. This issue is patched in Next.js 14.2.15 and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51479?
The severity of CVE-2024-51479 is considered to be high due to the potential for authorization bypass in Next.js applications.
How do I fix CVE-2024-51479?
To fix CVE-2024-51479, upgrade your Next.js application to version 14.2.15 or later.
Who is affected by CVE-2024-51479?
CVE-2024-51479 affects Next.js applications using authorization based on pathname prior to version 14.2.15.
What will happen if I don't patch CVE-2024-51479?
If you don't patch CVE-2024-51479, your Next.js application may be vulnerable to authorization bypass attacks.
Is this vulnerability specific to Next.js hosted on Vercel?
CVE-2024-51479 is not limited to Vercel; it affects any Next.js application using the vulnerable authorization method.