CVE-2020-15242 json
Open Redirect in Next.js
published 2020-10-08 6 y ago modified 2026-09-10 1 mo ago also EUVD-2020-1439 , GHSA-x56p-c8cg-q435
- cvss
- 4.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attackers domain from a trusted domain. The issue is fixed in version 9.5.4.
Patch / fix
- npm next 9.5.4
- vercel next.js 9.5.4
Exploit prediction
0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N |
| GitHub | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | next | >=9.5.0, <9.5.4 |
9.5.4 |
Affected products
- vercel next.js
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
- Technology feeds
References
-
github.com
/vercel/next.js/security/advisories/GHSA-x56p-c8cg-q435
web, patch, third-party-advisory, advisory
-
github.com
/zeit/next.js/releases/tag/v9.5.4
web, release-notes, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-15242
advisory
-
github.com
/vercel/next.js
package
Sources
- CVE List CVE-2020-15242
- GitHub Advisory GHSA-x56p-c8cg-q435
- NVD CVE-2020-15242
- Maintainer advisory GHSA-x56p-c8cg-q435
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of vercel/next.js published their own advisory on GitHub. Reviewed sources take precedence over it.