Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Next.js apps can skip authorization for root pages

CVE-2024-51479 · published 1 year ago
Summary

If your Next.js site checks user permission in middleware based on the page path, attackers could reach pages placed directly under the site’s root without being checked. Upgrade to Next.js version 14.2.15 or later to close the gap; sites hosted on Vercel are already protected. No other workarounds are needed.

What to do
  • Update vercel-release-bot next to version 14.2.15.
  • Update next to version 14.2.2-aikido.3.
  • Update rootio @rootio/next to version 14.2.2-root.io.3.
  • Update next to version 14.2.2-aikido.6.
  • Update rootio @rootio/next to version 14.2.2-root.io.6.
  • Update next to version 13.2.4-aikido.2.
  • Update rootio @rootio/next to version 13.2.4-root.io.2.
  • Update next to version 14.1.3-aikido.1.
  • Update rootio @rootio/next to version 14.1.3-root.io.1.
  • Update next to version 12.3.1-aikido.3.
  • Update rootio @rootio/next to version 12.3.1-root.io.3.
  • Update next to version 14.1.0-aikido.3.
  • Update rootio @rootio/next to version 14.1.0-root.io.3.
  • Update next to version 14.2.15-aikido.2.
  • Update rootio @rootio/next to version 14.2.15-root.io.2.
  • Update next to version 14.2.15-aikido.3.
  • Update rootio @rootio/next to version 14.2.15-root.io.3.
  • Update next to version 14.2.15-aikido.5.
  • Update rootio @rootio/next to version 14.2.15-root.io.5.
  • Update next to version 14.2.15-aikido.6.
  • Update rootio @rootio/next to version 14.2.15-root.io.6.
  • Update vercel next.js to version 14.2.15 or later.
Affected software
Ecosystem VendorProductAffected versions
npm vercel-release-bot next >= 9.5.5, < 14.2.15
Fix: upgrade to 14.2.15
– vercel next.js >= 9.5.5, < 14.2.15
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*
Root:npm – next < 14.2.2-aikido.3
< 14.2.2-aikido.6
< 13.2.4-aikido.2
< 14.1.3-aikido.1
< 12.3.1-aikido.3
< 14.1.0-aikido.3
< 14.2.15-aikido.2
< 14.2.15-aikido.3
< 14.2.15-aikido.5
< 14.2.15-aikido.6
Fix: upgrade to 14.2.2-aikido.3
Root:npm rootio @rootio/next < 14.2.2-root.io.3
< 14.2.2-root.io.6
< 13.2.4-root.io.2
< 14.1.3-root.io.1
< 12.3.1-root.io.3
< 14.1.0-root.io.3
< 14.2.15-root.io.2
< 14.2.15-root.io.3
< 14.2.15-root.io.5
< 14.2.15-root.io.6
Fix: upgrade to 14.2.2-root.io.3
Original advisory text
Authorization bypass in Next.js
Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
4% chance of attack within 30 days
Type
CWE-285Improper Authorization
CWE-863Incorrect Authorization
Timeline
Published17 Dec 2024
Updated25 Oct 2026
First seen6 Mar 2026
Sources
GHSA-7gfc-8cq8-jh5f · GHSA
CVE-2024-51479 · NVD
ROOT-APP-NPM-CVE-2024-51479 · OSV
CVE-2024-51479 · OSV
Track software like this
Free during beta