| Package | Affected versions | Patched versions |
|---|
| next.js | ≥ 11.1.4, < 12.3.5≥ 13.0.0, < 13.5.9≥ 14.0.0, < 14.2.25≥ 15.0.0, < 15.2.3
| 12.3.513.5.914.2.2515.2.3
|
| next npm | ≥ 12.0.0, < 12.3.5≥ 13.0.0, < 13.5.9≥ 14.0.0, < 14.2.25≥ 15.0.0, < 15.2.3
| 12.3.513.5.914.2.2515.2.3
|
Description
Impact
It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.
Patches
- For Next.js 15.x, this issue is fixed in
15.2.3
- For Next.js 14.x, this issue is fixed in
14.2.25
- For Next.js 13.x, this issue is fixed in 13.5.9
- For Next.js 12.x, this issue is fixed in 12.3.5
- For Next.js 11.x, consult the below workaround.
Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability.
Workaround
If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application.
Credits
- Allam Rachid (zhero;)
- Allam Yasser (inzo_)
NVD description
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free