GHSA-7gfc-8cq8-jh5fHighCVSS 7.5

Next.js authorization bypass vulnerability

Published
December 17, 2024
Last Modified
September 10, 2025

🔗 CVE IDs covered (1)

CVE-2024-51479 →

📋 Description

Impact

If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.

Patches

This issue was patched in Next.js 14.2.15 and later.

If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

We'd like to thank tyage (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.

🎯 Affected products1

  • npm/next:>= 9.5.5, < 14.2.15

🔗 References (5)