CVE-2021-37699: Open Redirect in Next.js
Summary
CVE-2021-37699: Open Redirect in Next.js. Affects next versions >= 0.9.9, < 11.1.0. Fixed in 11.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is an open source website development framework designed to be used with the React library. It provides a robust and efficient way to build server-side rendered React applications. Next.js allows developers to create static pages, server-side rendered pages, and dynamic pages with ease. It is widely used in the industry for building modern web applications.
Vulnerability Detail
The vulnerability identified as CVE-2021-37699 affects Next.js versions between 10.0.5 and 10.2.0, as well as versions 11.0.0 and 11.0.1. When the pages/_error.js file is statically generated, specially encoded paths can be used to trigger an open redirect to an external site. Although this redirect does not directly harm users, it can be exploited for phishing attacks by redirecting users to an attacker's domain from a trusted domain. It is important to note that deployments on Vercel are not affected, and versions prior to 0.9.9 of the next npm package are not vulnerable to this issue.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.1.0
This is the first release that contains the fix.
npm install next@11.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Next.js is not immediately feasible, a possible workaround is to use the pages/404.js file instead of pages/_error.js. Deployments with pages/404.js are not affected by this vulnerability. However, it is still recommended to upgrade to the latest version of Next.js as soon as possible.
Conclusion
In conclusion, the CVE-2021-37699 vulnerability in Next.js allows for open redirects to occur, potentially leading to phishing attacks. It is crucial to upgrade to the latest version of Next.js (version 11.1.0 or newer) to fix this vulnerability and improve the overall security of your application. If immediate upgrading is not possible, using pages/404.js can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for next →
FAQ
Next.js is an open source website development framework used with the React library. It provides a way to build server-side rendered React applications.
Next.js versions between 10.0.5 and 10.2.0, as well as versions 11.0.0 and 11.0.1, are affected by this vulnerability.
The vulnerability allows for open redirects to occur, which can be exploited for phishing attacks by redirecting users to an attacker's domain from a trusted domain.
No, deployments on Vercel are not affected by this vulnerability.
The recommended solution is to upgrade to the latest version of Next.js (version 11.1.0 or newer) to patch the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for next.
