CVE-2026-44575 in next.js
Summary
by MITRE • 05/13/2026
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/15/2026
This vulnerability affects Next.js applications using the App Router with middleware-based authorization controls, specifically impacting versions between 15.2.0 and 15.5.15, as well as 16.2.0 through 16.2.4. The flaw stems from how the framework handles route resolution for segment prefetching operations, creating a pathway for unauthorized access to protected content. The vulnerability manifests when applications rely on middleware for authorization checks, particularly those using transport-specific route variants that are intended to be distinct from regular page routes. The technical implementation allows attackers to craft specially formatted requests using .rsc (React Server Component) URLs and segment-prefetch endpoints that can resolve to the same underlying page content without triggering the expected authorization middleware rules. This represents a bypass of access control mechanisms that should prevent unauthorized users from accessing protected resources, effectively creating a backdoor through the application's routing system.
The operational impact of this vulnerability is significant as it undermines the fundamental security model of applications that depend on middleware for authorization. When properly configured, middleware should act as a gatekeeper, ensuring that only authenticated and authorized users can access specific routes or content segments. However, this vulnerability allows attackers to exploit the routing behavior during prefetch operations to gain access to protected resources without proper authentication. The attack vector specifically targets the distinction between regular page routes and prefetching routes, which are typically used by the framework to optimize performance by preloading content. This creates a scenario where legitimate prefetching functionality becomes a security weakness, as the same content can be accessed through different URL patterns that bypass authorization checks. The vulnerability affects applications that implement proxy-based authorization checks, which are common patterns in modern web applications where access control is enforced through middleware layers that inspect request properties and user credentials.
Security mitigations for this vulnerability involve updating to the fixed versions of Next.js, specifically 15.5.16 and 16.2.5, where the routing behavior has been corrected to ensure that prefetching routes properly respect authorization middleware rules. Organizations should implement comprehensive testing procedures to verify that their middleware configurations correctly handle all potential route variations and that authorization checks are consistently applied regardless of the request method or URL pattern used. The vulnerability aligns with CWE-284 Access Control Issues, specifically addressing insufficient access control mechanisms that allow unauthorized access to protected resources. From an ATT&CK perspective, this vulnerability maps to T1078 Valid Accounts and T1566 Phishing, as it could enable attackers to bypass authentication controls that would normally prevent unauthorized access. Additionally, this issue demonstrates the importance of proper route validation and input sanitization in web frameworks, particularly when dealing with dynamic routing and prefetching mechanisms that can be manipulated to access restricted content. Organizations should also consider implementing additional monitoring and logging of access patterns to detect potential exploitation attempts, as well as reviewing their middleware configurations to ensure that all potential request pathways are properly secured against unauthorized access attempts.