Next.js versions >= 12.2.0 and < 15.5.16, and >= 16.0.0 and < 16.2.5, when configured with Pages Router, i18n, and middleware or proxy-based authorization, improperly allow unauthorized access to protected page data. This occurs because middleware does not execute on the unprefixed locale-less data route /_next/data/<buildId>/<page>.json, enabling attackers to retrieve server-side rendered JSON for protected pages without authorization. The flaw corresponds to CWE-863 (Incorrect Authorization). The issue is resolved in versions 15.5.16 and 16.2.5.

Unauthorized users can access sensitive server-side rendered JSON data for protected pages, potentially exposing confidential information. The vulnerability does not affect integrity or availability but compromises confidentiality. No known active exploitation has been reported.

Upgrade Next.js to version 15.5.16 or later in the 15.x series, or 16.2.5 or later in the 16.x series, where this authorization bypass issue is fixed. Since this is a self-hosted framework, users must apply these updates themselves. Patch status is confirmed by the vendor's versioning and fixed releases. No alternative mitigations are indicated.