Next.js Authorization Bypass Vulnerability in Middleware

A vulnerability allowing authorization bypass in Next.js applications has been identified. This issue affects versions 9.5.5 through 14.2.14. The vulnerability arises when authorization in middleware is based on pathname, allowing bypass for pages directly under the application's root directory. For instance, authorization would be bypassed on 'https://example.com/foo' but not on 'https://example.com/' or 'https://example.com/foo/bar'. This vulnerability has been automatically mitigated for Next.js applications hosted on Vercel, regardless of the Next.js version.

Impact

Exploitation of this vulnerability allows for authorization bypass, potentially leading to unauthorized access to certain pages or resources within the application.

Remediation

Users can upgrade to Next.js version 14.2.15 or later to address this vulnerability. For applications hosted on Vercel, no action is needed as the vulnerability has already been mitigated.