CVE-2021-37699

low-risk

Published 2021-08-12

Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain. We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. The issue has been patched in release 11.1.0.

Do I need to act?

0.43% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.9/10 Medium

NETWORK / HIGH complexity

Affected Products (1)

Next.Js

Affected Vendors

Vercel

References (4)

Release Notes https://github.com/vercel/next.js/releases/tag/v11.1.0

Third Party Advisory https://github.com/vercel/next.js/security/advisories/GHSA-vxf5-wxwp-m7g9

Release Notes https://github.com/vercel/next.js/releases/tag/v11.1.0

Third Party Advisory https://github.com/vercel/next.js/security/advisories/GHSA-vxf5-wxwp-m7g9

/ 100

low-risk

Severity 21/34 · High

Exploitability 2/34 · Minimal

Exposure 5/34 · Minimal