Open Redirect in Next.js

The primary impact of CVE-2021-37699 is the potential for phishing attacks. An attacker could craft a malicious URL that, when clicked, redirects a user from a trusted Next.js domain to a fraudulent website designed to steal credentials or sensitive information. While the redirect itself doesn't directly harm the user's system, the subsequent phishing attack could have severe consequences, including account compromise and data theft. The vulnerability's reliance on pages/_error.js being statically generated limits its scope, but any application utilizing this configuration pattern is potentially at risk. This is similar to other open redirect vulnerabilities where trusted domains are leveraged to gain user trust before redirecting to malicious sites.

Organizations and developers using Next.js for website development, particularly those relying on the pages/_error.js file for error handling and static generation, are at risk. Shared hosting environments where multiple applications share the same server and configuration are also potentially vulnerable if they are running affected versions of Next.js.

• nodejs / server:

find /path/to/nextjs/pages/ -name _error.js -print

• generic web:

curl -I https://your-nextjs-app.com/malicious-redirect | grep Location

• generic web: Inspect access logs for requests containing suspicious redirect URLs (e.g., containing encoded characters or unusual domain names).

1. 2021-08-12Disclosure

   disclosure

1. आरक्षित2021-07-29
2. प्रकाशित2021-08-12
3. संशोधित2026-03-13
4. EPSS अद्यतन2026-04-02

The recommended mitigation for CVE-2021-37699 is to upgrade to Next.js version 11.1.0 or later, which includes the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block redirects to suspicious domains. Additionally, carefully review and sanitize any user-supplied input used in redirect URLs within your pages/_error.js file. Ensure proper validation and encoding to prevent malicious path manipulation. After upgrading, confirm the fix by attempting to trigger the redirect with a known malicious URL; the redirect should be blocked or handled securely.

अंतिम अपडेट

16.2.6हाल ही में