This upgrade is completely backwards compatible and recommended for all users on versions below 9.5.4. For future security related communications of our OSS projects, please join this mailing list.
A security team from one of our partners noticed an issue in Next.js that allowed for open redirects to occur.
Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site.
In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attackers domain from a trusted domain.
We recommend upgrading to the latest version of Next.js to improve the overall security of your application.
How to Upgrade
- We have released patch versions for both the stable and canary channels of Next.js.
- To upgrade run
npm install next@latest --save
Impact
- Affected: Users of Next.js between 9.5.0 and 9.5.3
- Not affected: Deployments on Vercel (https://vercel.com) are not affected
- Not affected: Deployments using
next export
We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.
How to Assess Impact
If you think users could have been affected, you can filter logs of affected sites by %2F with a 308 response.
What is Being Done
As Next.js has grown in popularity, it has received the attention of security teams and auditors. We are thankful to those that reached out for their investigation and discovery of the original bug and subsequent responsible disclosure.
We've landed a patch that ensures encoding is handled properly for these types of redirects so the open redirect can no longer occur.
Regression tests for this attack were added to the security integration test suite.
- We have notified known Next.js users in advance of this publication.
- A public CVE was released.
- If you want to stay on top of our security related news impacting Next.js or other Vercel projects, please join this mailing list.
- We encourage responsible disclosure of future issues. Please email us at security@vercel.com. We are actively monitoring this mailbox.
Core Changes
- Make the image post-processor ignore SVG images: #16732
- Only update lookups for dev overlay if mounted: #16776
- Ensure interpolating dynamic href values works correctly: #16774
- Add automatic reloading when editing GS(S)P methods: #16744
- Update to show build indicator while re-fetching GS(S)P data in dev: #16789
- make parseRelativeUrl return a UrlObject: #16809
- Add tests for searchParams dev warning: #16798
- Fix invalid config export errors: #16834
- Correct client rewrite resolving with query: #16860
- Fix href resolving with trailing slash enabled: #16873
- Divide export build output into 4 segments instead of showing it one by one: #16815
- Include additional query values when interpolating href: #16878
- Correct page path for GS(S)P data refreshing: #16939
- Fix align documentation with the code: #16843
- Remove
next-head-count: #16758
- Add Support for CSS Module Value Imports: #16973
- Fix resolving href with a rewrite: #16975
- Correct query behavior for falsey values to pre 9.5.1 behavior: #16608
Documentation Changes
- Add Fast Refresh Demo: #16576
- Update dynamic-import docs: #16803
- Update link docs to reflect changes on dynamic routing (#16634)
- Add handling for redirects from getStaticProps/getServerSideProps (#16642)
- Document CSS Grid Better: #16996
- Improve Asset Prefix Docs: #16998
- Update build time env variable link in the runtime config section: #17017
- fix gtag syntax in measuring docs: #16933
- docs(babelrc): precise usage without configuring plugins: #16779
- Improve Document Component Error: #17047
- Add missing comma in docs example: #17129
- Adds note about public directory: #17203
- Fix invalid href error message: #17183
- Update trailingSlash parameter name: #17228
- Update cdn-support-with-asset-prefix.md: #17237
- Docs(api-middlewares): use typings for serialize options from @types/cookie: #17285
- Remove reference to now env example: #17341
- Mention required version for global CSS imports in node_modules: #17506
- Mention
favicon.ico in static file serving docs.:
Example Changes
- force persistor persist again after persistStore bootstrap done: #16085
- Create _document.js to include current language in HTML tag: #16360
- [Example] Fix relay network request: #16525
- Minor spelling fix in zones example's readme: #16822
- Update
with-stitches example: #16827
- Undo unrequired readme changes done to examples: #16831
- chore(examples): fix missing document components error messages: #16802
- Use useRouter over Router for with-google-analytics example: #16846
- chore: update example names to match their folders: #16268
- [EXAMPLE] with-cssed: #16735
- update nextjs-auth0 versionfor auth0 example: #16871
- Remove path specific switch statement from http2 example: #16558
- Fix Three.js example's BoxesPage variable name: #16900
- Fix extension name for example app (#16916)
- Fix typo in Pet mongoose model: #16943
- Ignore .next also in subfolders: #16962
- Update with-slate example: #16959
- Adding globalStyled with styled components: #16783
Misc Changes
- Update to check for overlay in client nav tests: #17002
- Update workflow to use latest webpack 5 beta
- fix(eslint-plugin-next): support src/pages folder in no-html-link-for-pages rule: #16743
- Update no-document-viewport-meta.md
- Rename exportTrailingSlash to trailingSlash in docs: #17268
- Remove duplicate
should in test name: #17303
- Remove Random Blank Line in create-next-app: #17328
- Update release stats workflow: #17533
- Update release stats workflow: #17580
- test(create-next-app): increase coverage: #17507
- Update release stats workflow step to restore cache: #17656
Credits
Huge thanks to @YichiZ, @weichienhung, @atcastle, @ijjk, @seosmmbusiness, @HsuTing, @gsimone, @peduarte, @Janpot, @ztanner, @lfades, @neighborhood999, @chibicode, @merceyz, @opudalo, @lunchboxav, @mohsen1, @akd-io, @justman00, @helloworld, @devknoll, @borekb, @HaNdTriX, @ArthurMaverick, @sakito21, @TrySound, @omBratteng, @svenheden, @hallaji, @kettanaito, @vvo, @m-lautenbach, @jensmeindertsma, @Zeko369, @Timer, @longlho, @stefanprobst, @laugharn, @sdornan, @daneroo, @mohd-akram, @austingmhuang, @sphilee, @devinekadeni, @Bacher, @nghiepit, @tomasdisk, @leader22, @paulogdm, @284km, @belgattitude, @geritol, @stigkj, @sampoder, @samrobbins85, @Pitasi, @digitalPlayer1125, @timfee, @plug-n-play, @philihp, @leerob, @dylanjha, @Kerumen, @rdimaio, @jorisw, @zerbinidamata, @jamesgeorge007, @Jashnm, and @futantan for helping!
