CVE-2026-44573: CWE-863: Incorrect Authorization in vercel next.js
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.
AI Analysis
Technical Summary
Next.js versions >=12.2.0 <15.5.16 and >=16.0.0 <16.2.5 contain an authorization bypass vulnerability (CWE-863) when using the Pages Router with i18n and middleware or proxy-based authorization. The middleware does not execute for locale-less /_next/data/<buildId>/<page>.json requests, allowing attackers to retrieve server-side rendered JSON data for protected pages without passing authorization checks. This results in information disclosure of sensitive page data. The issue is resolved in Next.js versions 15.5.16 and 16.2.5. Red Hat's advisory confirms the vulnerability and states that no suitable mitigation other than upgrading is currently available.
Potential Impact
An attacker can remotely bypass intended authorization controls in affected Next.js applications configured with Pages Router and i18n, retrieving sensitive server-side rendered JSON data from protected pages. This leads to high confidentiality impact due to unauthorized information disclosure. Integrity and availability are not affected. The vulnerability requires no privileges or user interaction and can be exploited over the network.
Mitigation Recommendations
The vulnerability is fixed in Next.js versions 15.5.16 and 16.2.5. Users should upgrade to these or later versions to remediate the issue. According to the Red Hat advisory, no effective mitigation currently meets their criteria for ease of use, applicability, and stability. Therefore, upgrading to a fixed version is the recommended and primary remediation step.
CVE-2026-44573: CWE-863: Incorrect Authorization in vercel next.js
Description
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.
CVSS v3.1
Score 7.5high
Affected software
vercel
next.js
pkg:github/vercel/next.jsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Next.js versions >=12.2.0 <15.5.16 and >=16.0.0 <16.2.5 contain an authorization bypass vulnerability (CWE-863) when using the Pages Router with i18n and middleware or proxy-based authorization. The middleware does not execute for locale-less /_next/data/<buildId>/<page>.json requests, allowing attackers to retrieve server-side rendered JSON data for protected pages without passing authorization checks. This results in information disclosure of sensitive page data. The issue is resolved in Next.js versions 15.5.16 and 16.2.5. Red Hat's advisory confirms the vulnerability and states that no suitable mitigation other than upgrading is currently available.
Potential Impact
An attacker can remotely bypass intended authorization controls in affected Next.js applications configured with Pages Router and i18n, retrieving sensitive server-side rendered JSON data from protected pages. This leads to high confidentiality impact due to unauthorized information disclosure. Integrity and availability are not affected. The vulnerability requires no privileges or user interaction and can be exploited over the network.
Mitigation Recommendations
The vulnerability is fixed in Next.js versions 15.5.16 and 16.2.5. Users should upgrade to these or later versions to remediate the issue. According to the Red Hat advisory, no effective mitigation currently meets their criteria for ease of use, applicability, and stability. Therefore, upgrading to a fixed version is the recommended and primary remediation step.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-06T21:49:12.424Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-44573","vendor":"Red Hat"}]
Threat ID: 6a04af94cbff5d8610ed2993
Added to database: 05/13/2026, 17:06:28 UTC
Last enriched: 08/13/2026, 13:02:50 UTC
Last updated: 09/14/2026, 22:01:34 UTC
Views: 233
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.