Executive brief
Next.js is a popular JavaScript framework for building web applications. When a Next.js application uses middleware to enforce access control based on URL paths, attackers can bypass these authorization checks to access restricted resources without proper authentication or permissions. This could allow unauthorized users to view sensitive data or perform actions they shouldn't be permitted to do.
Technical details
The vulnerability is an improper authorization check (CWE-285, CWE-863) in Next.js middleware when performing pathname-based access control. Applications that rely on middleware to validate authorization based on request paths are vulnerable if running affected versions. The attack is network-accessible, requires no authentication or user interaction, and allows an attacker to bypass authorization policies to gain unauthorized access to protected resources. The vulnerability affects Next.js versions 9.5.5 through 14.2.14 and was patched in version 14.2.15 and later. Applications hosted on Vercel are automatically mitigated regardless of Next.js version.
Affected products
- Vercel Next.js 9.5.5 to 14.2.14
Timeline
- 2024-12-17: disclosed
- 2024-12-17: patched: Next.js 14.2.15 and later