CVE-2020-15242: Open Redirect in Next.js

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-08 · updated 2026-06-17
Weakness: CWE-601

Description

Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attackers domain from a trusted domain. The issue is fixed in version 9.5.4.

Affected products

Next.js: from 9.5.0 before 9.5.4 — fixed in 9.5.4

How to fix

Upgrade to a fixed version: Next.js 9.5.4. Check the vendor advisory for mitigations.

References

https://github.com/vercel/next.js/security/advisories/GHSA-x56p-c8cg-q435
https://github.com/zeit/next.js/releases/tag/v9.5.4
https://github.com/vercel/next.js/security/advisories/GHSA-x56p-c8cg-q435
https://github.com/zeit/next.js/releases/tag/v9.5.4

Get alerted when CVE-2020-15242 or the next vulnerability affects your stack