CVE-2026-44574 is an authentication bypass vulnerability in the Next.js React framework affecting versions >= 15.4.0 and < 15.5.16, and >= 16.0.0 and < 16.2.5. The issue arises because specially crafted query parameters can manipulate the dynamic route value used by the page, bypassing middleware authorization checks that protect dynamic routes. This allows unauthorized access to protected content. The vulnerability is categorized under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). It has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, and high confidentiality and integrity impact without availability impact. The issue is resolved in Next.js versions 15.5.16 and 16.2.5.

Exploitation of this vulnerability allows an attacker with low privileges to bypass middleware-based authorization on dynamic routes, potentially gaining unauthorized access to protected content. The confidentiality and integrity of the affected applications can be compromised. There is no indication of availability impact. No known exploits in the wild have been reported at this time.

A fix is available in Next.js versions 15.5.16 and 16.2.5. Users should upgrade to these or later versions to remediate this vulnerability. Since this is not a cloud service, remediation depends on the user applying the update. Patch status is confirmed by the version ranges fixed as stated in the description. No other mitigation steps are indicated.