CVE-2024-51479

A flaw was found in the Next.js framework. An incorrectly sanitized query parameter can cause an invalid routing condition, resulting in the wrong route being served to users and allowing authorization bypass when an application is performing path-based middleware authorization.

This issue affects self-hosted applications with a missing i18n configuration performing path-based middleware authorization. Applications hosted on Vercel are not vulnerable to this vulnerability.

Additionally, only pages under the root directory of the application are vulnerable to this issue, for example:

https://example.com/: not vulnerable

https://example.com/foo: vulnerable

https://example.com/foo/bar: not vulnerable

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.