CVE-2026-44574 is an authentication bypass vulnerability in the Next.js React framework affecting versions >=15.4.0 <15.5.16 and >=16.0.0 <16.2.5. The issue arises because middleware intended to protect dynamic routes can be bypassed by manipulating query parameters that change the dynamic route value seen by the page, while the visible URL path remains unchanged. This discrepancy allows unauthorized access to protected content without triggering the middleware authorization checks. The vulnerability is classified under CWE-288 (Authentication Bypass) and CWE-551 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality and integrity with no availability impact. The issue is resolved in Next.js versions 15.5.16 and 16.2.5.

Successful exploitation allows attackers to bypass middleware-based authorization on dynamic routes in affected Next.js applications, potentially exposing protected content to unauthorized users. This compromises confidentiality and integrity of the application data and functionality. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

A fix is available in Next.js versions 15.5.16 and 16.2.5. Users should upgrade affected Next.js deployments to these versions or later to remediate the vulnerability. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated by the vendor advisory.