Log in Start free

Vulnerability · Published May 13, 2026 · Assigned by GitHub_M

CVE-2026-44575Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

High 7.5

In plain English

A high-severity authentication bypass in next.js from vercel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.6%top 24.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmnext15.5.16GHSA-267c-6grr-h53f
npmnext16.2.5GHSA-267c-6grr-h53f

Affected products (as reported)

VendorProductVersions
vercel next.js >= 16.0.0, < 16.2.5>= 15.2.0, < 15.5.16

Weakness: CWE-288, CWE-551 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References