Publish Advisories

GHSA-7gfc-8cq8-jh5f GHSA-cwq8-g58r-32hg
2026-05-22 18:04:22 -07:00 · 2024-12-19 15:05:55 +00:00
parent df5d670c19
commit ccc4295f3e
2 changed files with 4 additions and 4 deletions
@@ -1,13 +1,13 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7gfc-8cq8-jh5f",
-  "modified": "2024-12-17T21:35:54Z",
+  "modified": "2024-12-19T15:04:21Z",
  "published": "2024-12-17T15:09:06Z",
  "aliases": [
    "CVE-2024-51479"
  ],
  "summary": "Next.js authorization bypass vulnerability",
-  "details": "### Impact\nIf a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example:\n\n* [Not affected] `https://example.com/`\n* [Affected] `https://example.com/foo`\n* [Not affected] `https://example.com/foo/bar`\n\n### Patches\nThis issue was patched in Next.js `14.2.15` and later.\n\nIf your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.\n\n### Workarounds\nThere are no official workarounds for this vulnerability.\n\n#### Credits\nWe'd like to thank [tyage](http://github.com/tyage) (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.",
+  "details": "### Impact\nIf a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.\n\n### Patches\nThis issue was patched in Next.js `14.2.15` and later.\n\nIf your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.\n\n### Workarounds\nThere are no official workarounds for this vulnerability.\n\n#### Credits\nWe'd like to thank [tyage](http://github.com/tyage) (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.",
  "severity": [
    {
      "type": "CVSS_V3",