GHSA-vxf5-wxwp-m7g9

Source

https://github.com/advisories/GHSA-vxf5-wxwp-m7g9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-vxf5-wxwp-m7g9/GHSA-vxf5-wxwp-m7g9.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-vxf5-wxwp-m7g9

Aliases

CVE-2021-37699

Related

CVE-2021-37699

Published

2021-08-12T14:51:14Z

Modified

2026-01-30T00:43:54.508150Z

Severity

6.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N CVSS Calculator

Summary

Open Redirect in Next.js

Details

Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated, allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although it can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain.

Impact

Affected: Users of Next.js between 10.0.5 and 10.2.0
Affected: Users of Next.js between 11.0.0 and 11.0.1 using pages/_error.js without getInitialProps
Affected: Users of Next.js between 11.0.0 and 11.0.1 using pages/_error.js and next export
Not affected: Deployments on Vercel (vercel.com) are not affected
Not affected: Deployments with pages/404.js
Note that versions prior to 0.9.9 package next npm package hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.

We recommend upgrading to the latest version of Next.js to improve the overall security of your application.

Patches

https://github.com/vercel/next.js/releases/tag/v11.1.0

Database specific

{
    "github_reviewed": true,
    "nvd_published_at": "2021-08-12T00:15:00Z",
    "cwe_ids": [
        "CWE-601"
    ],
    "github_reviewed_at": "2021-08-12T14:50:18Z",
    "severity": "MODERATE"
}

References

Affected packages

npm / next

Package

Name: next; View open source insights on deps.dev
Purl: pkg:npm/next

Affected ranges

Type: SEMVER
Events: Introduced

0.9.9

Fixed

11.1.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-vxf5-wxwp-m7g9/GHSA-vxf5-wxwp-m7g9.json"