Additional changes to review1 matched termMatched wording:no longerThese matches may be harmless in context. Expand to see the excerpts.
- The changelog contains the phrase “no longer”; its impact needs context.
We've landed a patch that ensures path parsing is handled properly for these paths so that the open redirect can no longer occur.
A security team from one of our partners noticed an issue in Next.js that allowed for an open redirect to occur.
Specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site.
In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain.
We recommend upgrading to the latest version of Next.js to improve the overall security of your application.
How to Upgrade
- We have released patch versions for both the stable and canary channels of Next.js.
- To upgrade run
npm install next@latest --save
Impact
- Affected: Users of Next.js between 10.0.5 and 10.2.0
- Affected: Users of Next.js between 11.0.0 and 11.0.1 using
pages/_error.jswithoutgetInitialProps - Affected: Users of Next.js between 11.0.0 and 11.0.1 using
pages/_error.jsandnext export - Not affected: Deployments on Vercel (vercel.com) are not affected
- Not affected: Deployments with
pages/404.js
We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.