リモートホストにインストールされている Next.js のバージョンは、14.2.15 より前の 9.5.5 です。したがって、ミドルウェアで承認チェックが発生する場合、承認バイパスの影響を受けます。

注意: スキャナーはこの問題を悪用しようとしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

遠端主機上安裝的 Next.js 9.5.5 版本早於 14.2.15。因此，如果在中介軟體中進行授權檢查，則會受到授權繞過影響。

請注意，掃描器程式並未嘗試利用此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程主机上安装的 Next.js 9.5.5 版本低于 14.2.15。因此，如果在中间件中进行授权检查，则会受到授权绕过漏洞的影响。

请注意，扫描程序并未试图利用此问题，而只依赖于应用程序自我报告的版本号。

The version of Next.js installed on the remote host is 9.5.5 prior to 14.2.15. It is, therefore, affected by Authorization Bypass if the authorization check occurs in middleware.

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js
    application is performing authorization in middleware based on pathname, it was possible for this
    authorization to be bypassed for pages directly under the application's root directory. For example: *
    [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected]
    `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js
    application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of
    Next.js version. There are no official workarounds for this vulnerability. (CVE-2024-51479)

ID	Name	Product	Family	Published	Updated	Severity
114768	Next.js 9.5.5 ～ 14.2.15 (含まない) 承認バイパス	Web App Scanning	Component Vulnerability	4/10/2025	4/10/2025	high
114768	Next.js 9.5.5 < 14.2.15 授權繞過	Web App Scanning	Component Vulnerability	4/10/2025	4/10/2025	high
114768	Next.js 9.5.5 < 14.2.15 授权绕过	Web App Scanning	Component Vulnerability	4/10/2025	4/10/2025	high
114768	Next.js 9.5.5 < 14.2.15 Authorization Bypass	Web App Scanning	Component Vulnerability	4/10/2025	4/10/2025	high
412052	SCA: security update for next (GHSA-7gfc-8cq8-jh5f)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	high
412052	SCA: security update for next (GHSA-7gfc-8cq8-jh5f)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high