CVE-2026-44575: CWE-288: Authentication Bypass Using an Alternate Path or Channel in vercel next.js
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.
AI Analysis
Technical Summary
Next.js versions >=15.2.0 <15.5.16 and >=16.0.0 <16.2.5 contain an authentication bypass vulnerability (CWE-288) in App Router applications relying on middleware or proxy-based authorization. Specially crafted .rsc and segment-prefetch URLs can bypass middleware authorization checks because transport-specific route variants are not consistently matched by middleware rules. This allows remote attackers to access protected content without proper authorization. The issue is resolved in Next.js versions 15.5.16 and 16.2.5. Red Hat's advisory confirms the vulnerability and states that no current mitigations meet their criteria, recommending upgrading to fixed versions when available.
Potential Impact
The vulnerability allows remote attackers to bypass authorization checks in affected Next.js App Router applications, leading to unauthorized access to protected content. The CVSS v3.1 score is 7.5 (high severity) with network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact. Integrity and availability are not affected. There are no known exploits in the wild at this time.
Mitigation Recommendations
The vulnerability is fixed in Next.js versions 15.5.16 and 16.2.5. Users should upgrade to these or later versions to remediate the issue. Red Hat's advisory states that no effective mitigations currently meet their criteria for ease of use and applicability, so upgrading is the recommended course of action. Monitor vendor advisories for updates and apply patches promptly once available.
CVE-2026-44575: CWE-288: Authentication Bypass Using an Alternate Path or Channel in vercel next.js
Description
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.
CVSS v3.1
Score 7.5high
Affected software
vercel
next.js
pkg:github/vercel/next.jsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Next.js versions >=15.2.0 <15.5.16 and >=16.0.0 <16.2.5 contain an authentication bypass vulnerability (CWE-288) in App Router applications relying on middleware or proxy-based authorization. Specially crafted .rsc and segment-prefetch URLs can bypass middleware authorization checks because transport-specific route variants are not consistently matched by middleware rules. This allows remote attackers to access protected content without proper authorization. The issue is resolved in Next.js versions 15.5.16 and 16.2.5. Red Hat's advisory confirms the vulnerability and states that no current mitigations meet their criteria, recommending upgrading to fixed versions when available.
Potential Impact
The vulnerability allows remote attackers to bypass authorization checks in affected Next.js App Router applications, leading to unauthorized access to protected content. The CVSS v3.1 score is 7.5 (high severity) with network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact. Integrity and availability are not affected. There are no known exploits in the wild at this time.
Mitigation Recommendations
The vulnerability is fixed in Next.js versions 15.5.16 and 16.2.5. Users should upgrade to these or later versions to remediate the issue. Red Hat's advisory states that no effective mitigations currently meet their criteria for ease of use and applicability, so upgrading is the recommended course of action. Monitor vendor advisories for updates and apply patches promptly once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-06T21:49:12.424Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-44575","vendor":"Red Hat"}]
Threat ID: 6a04af94cbff5d8610ed2999
Added to database: 05/13/2026, 17:06:28 UTC
Last enriched: 08/13/2026, 13:03:20 UTC
Last updated: 09/14/2026, 22:01:34 UTC
Views: 166
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.