CVE-2021-37699: medium-severity vulnerability in vercel next.js
Open Redirect in Next.js versions below 11.1.0
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Next.js versions before 11.1.0 allow attackers to craft specially encoded URLs that redirect users to external malicious websites when the error page is statically generated. This can be exploited for phishing attacks by making users trust a redirect from a legitimate domain.
Open redirect vulnerability in statically generated _error.js pages allows attackers to bypass redirect validation through specially encoded path manipulation, enabling redirection to attacker-controlled domains. This requires static generation of the error page and can be chained with social engineering for credential harvesting or malware distribution.
In the same product, most dangerous first.