CVE-2026-44573

Published May 13, 2026

Last updated a month ago

Next.js

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-44573 is identified as a Pages Router i18n Middleware Bypass vulnerability affecting applications built with Next.js. This flaw specifically impacts applications that utilize the Pages Router with internationalization (i18n) configured in conjunction with middleware-based authorization. The vulnerability allows locale-less requests to `/next/data/<buildId>/<page>.json` to completely bypass the middleware. This bypass enables attackers to retrieve server-side rendered JSON data for pages that should otherwise be protected by authorization checks. To address this, the matcher logic has been updated to ensure consistent matching for both prefixed and unprefixed data routes.

Description: Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.
Source: security-advisories@github.com
NVD status: Analyzed
Products: next.js

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-863

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "31A12CFA-9A52-4285-B5F3-E5FAD69DF477",
            "versionEndExcluding": "15.5.16",
            "versionStartIncluding": "12.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "27C5CF7A-7A33-4BE4-B8FD-10BFD813204A",
            "versionEndExcluding": "16.2.5",
            "versionStartIncluding": "16.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.