CVE-2024-51479

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 14.2.15

Description The issue is related to authorization bypass in Next.js applications when authorization is performed in middleware based on pathname. This allows attackers to bypass security checks for pages directly under the application's root directory. For example, https://example.com/foo is affected, while https://example.com/ and https://example.com/foo/bar are not. The vulnerability affects millions of developers and has been automatically mitigated for applications hosted on Vercel, regardless of the Next.js version. There are no official workarounds for this vulnerability.

Recommendations For Next.js versions prior to 14.2.15, upgrade to version 14.2.15 or later to resolve the issue. If your Next.js application is hosted on Vercel, no action is required as the vulnerability has been automatically mitigated. As a temporary workaround, consider restricting access to sensitive pages or disabling middleware-based authorization until a patch is applied.