{"id":"CVE-2024-51479","published":"2024-12-17T18:13:02Z","modified":"2024-12-17T20:36:28Z","title":"Authorization bypass in Next.js","vendor":"vercel","product":"next.js","tier":"tail","description":{"text":"Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03995,"percentile":0.90522,"provenance":"source"},"cwes":[{"id":"CWE-285","name":"Improper Authorization"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/vercel/next.js/releases/tag/v14.2.15","tags":["x_refsource_MISC"]}],"priority":{"score":23.4,"factors":[{"name":"EPSS percentile","points":18.1},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"vercel","affectedVersions":[{"vendor":"vercel","product":"next.js","versions":[">= 9.5.5, < 14.2.15"]}],"affected":[{"ecosystem":"npm","package":"next","vulnerableRanges":[">=9.5.5, <14.2.15"],"patched":["14.2.15"],"from":["GHSA-7gfc-8cq8-jh5f"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3534","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-34351","published":"2024-05-09","fixed":"14.1.1","kev":false},{"cve":"CVE-2024-47831","published":"2024-10-14","fixed":"14.2.7","kev":false},{"cve":"CVE-2024-46982","published":"2024-09-17","fixed":"14.2.10","kev":false,"link":{"from":"CVE-2024-46982","to":"CVE-2024-51479","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:next","fromFixed":"14.2.10","toFixed":"14.2.15","daysApart":91}]}},{"cve":"CVE-2024-51479","published":"2024-12-17","fixed":"14.2.15","kev":false},{"cve":"CVE-2024-56332","published":"2025-01-03","fixed":"15.1.2","kev":false,"link":{"from":"CVE-2024-51479","to":"CVE-2024-56332","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:next","fromFixed":"14.2.15","toFixed":"14.2.21","daysApart":17}]}},{"cve":"CVE-2025-32421","published":"2025-05-14","fixed":"15.1.6","kev":false},{"cve":"CVE-2025-49826","published":"2025-07-03","fixed":"15.1.8","kev":false}],"package":"npm:next"}}