Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| next | npm | < 14.2.32 | 14.2.32 |
| next | npm | >= 15.0.0-canary.0, < 15.4.7 | 15.4.7 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in how Next.js middleware responses with a Location header are processed. The provided patch 9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8 clearly shows that the getResolveRoutes function in packages/next/src/server/lib/router-utils/resolve-routes.ts was modified to address this issue. Before the patch, any response from a middleware that included a Location header was treated as a redirect, and the server would attempt to fetch the URL from this header. This behavior could be abused for SSRF attacks. The fix introduces a check to ensure that the response's status code is a valid redirect status before treating the Location header as a redirect. Therefore, the getResolveRoutes function is the specific location of the vulnerable code that, when triggered, would appear in a runtime profile during exploitation.
