Read the docs
TI-2021-15574 Aliases CVE-2021-37699GHSA-vxf5-wxwp-m7g9

Open Redirect in Next.js versions below 11.1.0

Priority LOW 32CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain. We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. The issue has been patched in release 11.1.0.

Why it matters now

EPSS 0.01033 63rd percentileScored 2026-11-07
Fix Fixed next.js (vercel): 11.1.0next (npm): 11.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
vercelnext.jsbefore 11.1.011.1.0Patch availableCNA
—next (npm)0.9.9 to before 11.1.011.1.0Patch availableGHSA-vxf5-wxwp-m7g9
  • next.js Vendorvercel Affected before 11.1.0 Fixed in 11.1.0 Patch available CNA
  • next (npm) Vendor— Affected 0.9.9 to before 11.1.0 Fixed in 11.1.0 Patch available GHSA-vxf5-wxwp-m7g9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*10.0.5 – 10.2.0; 11.0.0 – 11.0.1Vulnerablevercel
  • cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* Versions 10.0.5 – 10.2.0; 11.0.0 – 11.0.1 Vulnerable ·vercel

Remediation

  • Fix · CNA next.js (vercel) Fixed in 11.1.0
  • Fix · GHSA-vxf5-wxwp-m7g9 next (npm) Fixed in 11.1.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-37699
  2. 2026-10-03 Alias added: GHSA-vxf5-wxwp-m7g9

References

Advisory 3

Other 1

  • TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-21309 Authorization Bypass in Next.js Middleware CVSS 3.1CRITICAL 9.1
  • TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
  • TI-2024-31371 Cache Poisoning in next.js CVSS 3.1HIGH 7.5
  • TI-2023-24914 Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch… CVSS 3.1HIGH 7.5
  • TI-2026-32490 Next.js: Server-side request forgery in applications using WebSocket upgrades CVSS 3.1HIGH 8.6
See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences