Open Redirect in Next.js versions

中 6.1CVE-2020-15242 · GHSA-x56p-c8cg-q435 · 08/10/2020 公開 · 17/06/2026 更新

要点

CVE-2020-15242 は next.js (vercel), next に影響する深刻度「中」 (CVSS 6.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.77%（全脆弱性の 55.7% より高い）。
対処：9.5.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
next.js vercel	`≥ 9.5.0, < 9.5.4`	`9.5.4`
next npm	`≥ 9.5.0, < 9.5.4`	`9.5.4`

概要

Impact

Affected: Users of Next.js between 9.5.0 and 9.5.3
Not affected: Deployments on Vercel (https://vercel.com) are not affected
Not affected: Deployments using next export

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

Patches

https://github.com/vercel/next.js/releases/tag/v9.5.4

References

https://github.com/vercel/next.js/releases/tag/v9.5.4

NVD の説明

Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attackers domain from a trusted domain. The issue is fixed in version 9.5.4.