Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.

The version of Next.js installed on the remote host is 9.5.5 prior to 14.2.15. It is, therefore, affected by Authorization Bypass if the authorization check occurs in middleware.

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js
    application is performing authorization in middleware based on pathname, it was possible for this
    authorization to be bypassed for pages directly under the application's root directory. For example: *
    [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected]
    `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js
    application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of
    Next.js version. There are no official workarounds for this vulnerability. (CVE-2024-51479)

ID	Name	Product	Family	Severity
114768	Next.js 9.5.5 < 14.2.15 Authorization Bypass	Web App Scanning	Component Vulnerability	high
412052	SCA: security update for next (GHSA-7gfc-8cq8-jh5f)	Tenable Cloud Security	SCA Checks	high
412052	SCA: security update for next (GHSA-7gfc-8cq8-jh5f)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2024-51479

high

Tenable Plugins

high

high

high