vercel next.js up to 15.5.15/16.2.4 /_next/data/.json authorization

Summaryinfo

A vulnerability was found in vercel next.js up to 15.5.15/16.2.4. It has been classified as problematic. The affected element is an unknown function of the file /_next/data/.json. This manipulation causes authorization. This vulnerability is registered as CVE-2026-44573. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in vercel next.js up to 15.5.15/16.2.4. Affected by this vulnerability is an unknown code block of the file /_next/data/.json. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. As an impact it is known to affect confidentiality. The summary by CVE is:

Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-44573 since 05/06/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:_next/data/.json it is possible to find vulnerable targets with Google Hacking. The vulnerability scanner Nessus provides a plugin with the ID 314910 (Next.js Framework 12.2.x < 15.5.16 / 16.x < 16.2.5 Information Disclosure), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 15.5.16 or 16.2.5 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (314910) and CERT Bund (WID-SEC-2026-1401). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Vercel Next.js

Productinfo

Type

• JavaScript Library

Vendor

• vercel

Name

• next.js

Version

• 15.5.0
• 15.5.1
• 15.5.2
• 15.5.3
• 15.5.4
• 15.5.5
• 15.5.6
• 15.5.7
• 15.5.8
• 15.5.9
• 15.5.10
• 15.5.11
• 15.5.12
• 15.5.13
• 15.5.14
• 15.5.15
• 16.2.0
• 16.2.1
• 16.2.2
• 16.2.3
• 16.2.4

Website

• Product: https://github.com/vercel/next.js/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion