CVE-2026-44573 is an incorrect authorization vulnerability (CWE-863) in the Next.js React framework affecting versions >=12.2.0 <15.5.16 and >=16.0.0 <16.2.5. When applications use the Pages Router with internationalization (i18n) configured and rely on middleware or proxy-based authorization, the middleware does not run for unprefixed locale-less data routes (/_next/data/<buildId>/<page>.json). This allows attackers to bypass authorization checks and retrieve server-side rendered JSON data for protected pages without proper authentication. The vulnerability is addressed in Next.js versions 15.5.16 and 16.2.5. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Unauthorized users can access server-side rendered JSON data for protected pages in affected Next.js applications configured with i18n and middleware/proxy authorization. This leads to a confidentiality breach of potentially sensitive page data without requiring authentication or user interaction. There is no impact on integrity or availability.

Upgrade Next.js to version 15.5.16 or later in the 15.x branch, or 16.2.5 or later in the 16.x branch to apply the official fix. Patch status is confirmed fixed in these versions. Until upgrading, avoid configurations that combine Pages Router with i18n and middleware/proxy authorization that rely on locale-less data routes, or implement additional authorization checks on these data endpoints.