CVE-2021-37699

Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain. We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. The issue has been patched in release 11.1.0.

• CWE-601
• CWE-601

• https://github.com/vercel/next.js/releases/tag/v11.1.0Release Notes, Third Party Advisory
• https://github.com/vercel/next.js/security/advisories/GHSA-vxf5-wxwp-m7g9Third Party Advisory
• https://github.com/vercel/next.js/releases/tag/v11.1.0Release Notes, Third Party Advisory
• https://github.com/vercel/next.js/security/advisories/GHSA-vxf5-wxwp-m7g9Third Party Advisory

Published

Aug 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37693Discourse is an open-source platform for community discussio…7.5
• CVE-2021-37694@asyncapi/java-spring-cloud-stream-template generates a Spri…7.8
• CVE-2021-37695ckeditor is an open source WYSIWYG HTML editor with rich con…5.4
• CVE-2021-37696tmerc-cogs are a collection of open source plugins for the R…6.5
• CVE-2021-37697tmerc-cogs are a collection of open source plugins for the R…6.5
• CVE-2021-37698Icinga is a monitoring system which checks the availability …7.5
• CVE-2021-3770vim is vulnerable to Heap-based Buffer Overflow7.8
• CVE-2021-37700@github/paste-markdown is an npm package for pasting markdow…6.1
• CVE-2021-37701The npm package "tar" (aka node-tar) before versions 4.4.16,…8.6
• CVE-2021-37702Pimcore is an open source data & experience management platf…8.8
• CVE-2021-37703Discourse is an open-source platform for community discussio…4.3
• CVE-2021-37704PhpFastCache is a high-performance backend cache system (pac…4.3