Next.js RSC Segment Prefetch Bypass Pre-15.5.16, 16.2.5
CVE-2026-44575 Published on May 13, 2026

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.

NVD

Vulnerability Analysis

CVE-2026-44575 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Types

Authentication Bypass Using an Alternate Path or Channel

A product requires authentication, but the product has an alternate path or channel that does not require authentication.

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection. For instance, the character strings /./ and / both mean current directory. If /SomeDirectory is a protected directory and an attacker requests /./SomeDirectory, the attacker may be able to gain access to the resource if /./ is not converted to / before the authorization check is performed.


Products Associated with CVE-2026-44575

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-44575 are published in these products:

Vercel Next Js
 
Red Hat Enterprise Linux Ai
 
Red Hat Trusted Artifact Signer
 
Red Hat Amq Streams
 
Red Hat Enterprise Linux (RHEL)
 

Affected Versions

vercel next.js: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Trusted Artifact Signer: Red Hat streams for Apache Kafka 2: Red Hat streams for Apache Kafka 3: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9:

Exploit Probability

EPSS
1.05%
Percentile
59.76%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.