https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T17:37:49.390524+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-57830 cnvd-2020-57830 2026-10-10T17:37:49.461533+00:00 cnvd-2020-57830 https://cve.radiocsirt.org/vuln/euvd-2026-42783 EUVD-2026-42783 2026-10-10T17:37:49.461578+00:00 EUVD-2026-42783 https://cve.radiocsirt.org/vuln/fkie_cve-2020-15242 fkie_cve-2020-15242 2026-10-10T17:37:49.461599+00:00

Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attackers domain from a trusted domain. The issue is fixed in version 9.5.4.

 https://cve.radiocsirt.org/vuln/ghsa-x56p-c8cg-q435 GHSA-x56p-c8cg-q435 — Open Redirect in Next.js versions 2026-10-10T17:37:49.461645+00:00

Affected: npm: next

### Impact

- **Affected**: Users of Next.js between 9.5.0 and 9.5.3 - **Not affected**: Deployments on Vercel ([https://vercel.com](https://vercel.com)) are not affected - **Not affected**: Deployments using `next export`

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

### Patches

https://github.com/vercel/next.js/releases/tag/v9.5.4

### References

https://github.com/vercel/next.js/releases/tag/v9.5.4

 https://cve.radiocsirt.org/vuln/gsd-2020-15242 gsd-2020-15242 2026-10-10T17:37:49.461695+00:00 gsd-2020-15242