CVE-2020-15242: Open Redirect in Next.js
Summary
CVE-2020-15242: Open Redirect in Next.js versions. Affects next versions >= 9.5.0, < 9.5.4. Fixed in 9.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is a popular framework for building server-side rendered (SSR) and static websites using React. It provides a seamless development experience with features like automatic code splitting, server-side rendering, and static site generation. However, Next.js versions between 9.5.0 and 9.5.3 are vulnerable to an open redirect vulnerability.
Vulnerability Detail
The open redirect vulnerability in Next.js allows an attacker to redirect users to a malicious website by manipulating the URL. This can lead to various attacks, such as phishing, where the attacker tricks users into visiting a fake website and stealing their sensitive information. The vulnerability affects users of Next.js versions between 9.5.0 and 9.5.3. Deployments on Vercel and using next export are not affected. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2020-15242.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.5.4
This is the first release that contains the fix.
npm install next@9.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the fix instructions and upgrade Next.js to the latest version.
Conclusion
The open redirect vulnerability in Next.js versions between 9.5.0 and 9.5.3 can be mitigated by upgrading to version 9.5.4 or later. It is important to keep your Next.js installation up to date to ensure the security of your application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for next →
FAQ
Next.js is a framework for building server-side rendered (SSR) and static websites using React. It provides features like automatic code splitting, server-side rendering, and static site generation.
The open redirect vulnerability allows an attacker to redirect users to a malicious website by manipulating the URL. This can lead to various attacks, such as phishing, where the attacker tricks users into visiting a fake website and stealing their sensitive information.
Next.js versions between 9.5.0 and 9.5.3 are affected by this vulnerability.
No, deployments on Vercel are not affected by this vulnerability.
To mitigate this vulnerability, it is recommended to upgrade Next.js to version 9.5.4 or later. The patch for this vulnerability can be found in the Next.js releases page.
Related vulnerabilities
Recent vulnerabilities recorded for next.
