Medium severity6.9NVD Advisory· Published Aug 12, 2021· Updated Jun 17, 2026
CVE-2021-37699
CVE-2021-37699
Description
Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain. We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. The issue has been patched in release 11.1.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
nextnpm | >= 0.9.9, < 11.1.0 | 11.1.0 |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-vxf5-wxwp-m7g9ghsaADVISORY
- github.com/vercel/next.js/releases/tag/v11.1.0nvdRelease NotesThird Party AdvisoryWEB
- github.com/vercel/next.js/security/advisories/GHSA-vxf5-wxwp-m7g9nvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2021-37699ghsaADVISORY
News mentions
0No linked articles in our index yet.