{"id":"CVE-2024-51479","published":"2024-12-17T18:13:02Z","modified":"2024-12-17T20:36:28Z","title":"Authorization bypass in Next.js","vendor":"vercel","product":"next.js","tier":"tail","description":{"text":"Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03995,"percentile":0.90508,"provenance":"source"},"cwes":[{"id":"CWE-285","name":"Improper Authorization"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/vercel/next.js/releases/tag/v14.2.15","tags":["x_refsource_MISC"]}],"priority":{"score":23.4,"factors":[{"name":"EPSS percentile","points":18.1},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"vercel","affectedVersions":[{"vendor":"vercel","product":"next.js","versions":[">= 9.5.5, < 14.2.15"]}],"affected":[{"ecosystem":"npm","package":"next","vulnerableRanges":[">=9.5.5, <14.2.15"],"patched":["14.2.15"],"from":["GHSA-7gfc-8cq8-jh5f"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3534","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-vercel-next-js-cve-2023-46298","parents":[{"from":"CVE-2024-46982","to":"CVE-2024-51479","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:next","fromFixed":"14.2.10","toFixed":"14.2.15","daysApart":91},{"kind":"same-code","provenance":"machine","files":["packages/next/src/server/base-server.ts"],"commits":["https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3","https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda","https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b"],"basis":"shared function","functions":["Server"]}]},{"from":"CVE-2023-46298","to":"CVE-2024-51479","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/next/src/server/base-server.ts"],"commits":["https://github.com/vercel/next.js/commit/20d05958ff853e9c9e42139ffec294336881c648","https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b"],"basis":"shared function","functions":["Server"]}]}],"children":[{"from":"CVE-2024-51479","to":"CVE-2025-49005","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/next/src/server/base-server.ts"],"commits":["https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b","https://github.com/vercel/next.js/commit/ec202eccf05820b60c6126d6411fe16766ecc066"],"basis":"shared function","functions":["Server"]}]},{"from":"CVE-2024-51479","to":"CVE-2025-49826","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/next/src/server/base-server.ts"],"commits":["https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b","https://github.com/vercel/next.js/commit/a15b974ed707d63ad4da5b74c1441f5b7b120e93","https://github.com/vercel/next.js/commit/16bfce64ef2157f2c1dfedcfdb7771bc63103fd2"],"basis":"shared function","functions":["Server"]}]},{"from":"CVE-2024-51479","to":"CVE-2025-57822","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/next/src/server/lib/router-utils/resolve-routes.ts"],"commits":["https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b","https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8"],"basis":"shared function","functions":["getResolveRoutes"]}]}],"packageHistory":[{"cve":"CVE-2024-34351","published":"2024-05-09","fixed":"14.1.1","kev":false},{"cve":"CVE-2024-47831","published":"2024-10-14","fixed":"14.2.7","kev":false},{"cve":"CVE-2024-46982","published":"2024-09-17","fixed":"14.2.10","kev":false},{"cve":"CVE-2024-51479","published":"2024-12-17","fixed":"14.2.15","kev":false},{"cve":"CVE-2024-56332","published":"2025-01-03","fixed":"15.1.2","kev":false,"link":{"from":"CVE-2024-51479","to":"CVE-2024-56332","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:next","fromFixed":"14.2.15","toFixed":"14.2.21","daysApart":17}]}},{"cve":"CVE-2025-32421","published":"2025-05-14","fixed":"15.1.6","kev":false},{"cve":"CVE-2025-49826","published":"2025-07-03","fixed":"15.1.8","kev":false}],"package":"npm:next"}}