Next.js Auth Bypass via Middleware (15.4.0-15.5.16, 16.2.5)
CVE-2026-44574 Published on May 13, 2026

Next.js: Middleware / Proxy bypass through dynamic route parameter injection
Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 15.5.16 and 16.2.5.

NVD

Vulnerability Analysis

CVE-2026-44574 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Types

Authentication Bypass Using an Alternate Path or Channel

A product requires authentication, but the product has an alternate path or channel that does not require authentication.

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection. For instance, the character strings /./ and / both mean current directory. If /SomeDirectory is a protected directory and an attacker requests /./SomeDirectory, the attacker may be able to gain access to the resource if /./ is not converted to / before the authorization check is performed.


Products Associated with CVE-2026-44574

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-44574 are published in these products:

Vercel Next Js
 
Red Hat Enterprise Linux Ai
 
Red Hat Trusted Artifact Signer
 
Red Hat Amq Streams
 
Red Hat Enterprise Linux (RHEL)
 

Affected Versions

vercel next.js: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Trusted Artifact Signer: Red Hat streams for Apache Kafka 2: Red Hat streams for Apache Kafka 3: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9:

Exploit Probability

EPSS
0.38%
Percentile
29.94%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.