CVE-2020-15242

score

<0.1

cvss

4.7

epss

0.8%

published

2020-10-08

kev added

—

first seen

2026-10-21

Next.js versions >=9.5.0 and <9.5.4 contain an open redirect caused by specially encoded paths with trailing slash, letting attackers redirect users to external malicious sites, exploit requires crafted URL.