Next.js versions >=15.4.0 <15.5.16 and >=16.0.0 <16.2.5 contain an authorization bypass vulnerability (CWE-288) where specially crafted query parameters can alter the dynamic route value seen by the page without changing the visible path. This allows protected content to be rendered without passing the expected middleware authorization checks. The vulnerability affects applications relying on Next.js middleware to protect dynamic routes. The issue is fixed in versions 15.5.16 and 16.2.5. Red Hat has acknowledged the vulnerability affecting their products that use Next.js but currently does not provide a mitigation or patch that meets their deployment criteria. The CVSS v3.1 score is 8.1 (High), indicating a network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact.

An attacker can bypass authorization checks in Next.js applications that use middleware to protect dynamic routes, potentially gaining unauthorized access to sensitive or restricted content. This can lead to exposure of confidential information and unauthorized use of application features. The vulnerability does not impact availability. Red Hat products incorporating Next.js middleware protections may be affected, increasing risk in those environments.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, applicability, or stability. Users are advised to upgrade to Next.js versions 15.5.16 or 16.2.5 or later where the vulnerability is fixed. For Red Hat products, monitor vendor advisories for updates or patches. Until a fix is available, carefully review middleware protections and consider restricting access through alternative controls if feasible.