MEDIUM4.7

GHSA-x56p-c8cg-q435

Open Redirect in Next.js versions

Quick fix

GHSA-x56p-c8cg-q435 — next: upgrade to the fixed version with the command below.

npm install next@9.5.4

Details

### Impact

- **Affected**: Users of Next.js between 9.5.0 and 9.5.3 - **Not affected**: Deployments on Vercel ([https://vercel.com](https://vercel.com)) are not affected - **Not affected**: Deployments using `next export`

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

### Patches

https://github.com/vercel/next.js/releases/tag/v9.5.4

### References

https://github.com/vercel/next.js/releases/tag/v9.5.4

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/next

Introduced in: 9.5.0Fixed in: 9.5.4

Fixnpm install next@9.5.4

References

https://github.com/vercel/next.js/security/advisories/GHSA-x56p-c8cg-q435[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2020-15242[ADVISORY]
https://github.com/vercel/next.js[PACKAGE]
https://github.com/zeit/next.js/releases/tag/v9.5.4[WEB]