Next.js authorization bypass vulnerability
GHSA-7gfc-8cq8-jh5f · CVE-2024-51479
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.
Patches
This issue was patched in Next.js 14.2.15 and later.
If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.
Workarounds
There are no official workarounds for this vulnerability.
Credits
We'd like to thank tyage (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.
References
- WEB https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-51479
- WEB https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b
- PACKAGE https://github.com/vercel/next.js
- WEB https://github.com/vercel/next.js/releases/tag/v14.2.15
Ready to move
Start Securing
Free, no credit card | First findings in minutes