Read the docs
TI-2020-12014 Aliases CVE-2020-15242GHSA-x56p-c8cg-q435

Open Redirect in Next.js

Priority LOW 29CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attackers domain from a trusted domain. The issue is fixed in version 9.5.4.

Why it matters now

EPSS 0.00773 55th percentileScored 2026-11-07
Fix Fixed next.js (vercel): 9.5.4next (npm): 9.5.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
vercelnext.js9.5.0 to before 9.5.49.5.4Patch availableCNA
—next (npm)9.5.0 to before 9.5.49.5.4Patch availableGHSA-x56p-c8cg-q435
  • next.js Vendorvercel Affected 9.5.0 to before 9.5.4 Fixed in 9.5.4 Patch available CNA
  • next (npm) Vendor— Affected 9.5.0 to before 9.5.4 Fixed in 9.5.4 Patch available GHSA-x56p-c8cg-q435

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*9.5.0 to before 9.5.4Vulnerablevercel
  • cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* Versions 9.5.0 to before 9.5.4 Vulnerable ·vercel

Remediation

  • Fix · CNA next.js (vercel) Fixed in 9.5.4
  • Fix · GHSA-x56p-c8cg-q435 next (npm) Fixed in 9.5.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15242
  2. 2026-10-03 Alias added: GHSA-x56p-c8cg-q435

References

Patch 1

Advisory 2

Other 1

  • TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-21309 Authorization Bypass in Next.js Middleware CVSS 3.1CRITICAL 9.1
  • TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
  • TI-2024-31371 Cache Poisoning in next.js CVSS 3.1HIGH 7.5
  • TI-2023-24914 Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch… CVSS 3.1HIGH 7.5
  • TI-2026-32490 Next.js: Server-side request forgery in applications using WebSocket upgrades CVSS 3.1HIGH 8.6
See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences