CVE-2026-44575 is an authentication bypass vulnerability in the Next.js React framework affecting App Router applications relying on middleware or proxy-based authorization checks. In affected versions (>=15.2.0 <15.5.16 and >=16.0.0 <16.2.5), specially crafted .rsc and segment-prefetch URLs can resolve to the same page without triggering the expected middleware authorization rules, allowing unauthorized access to protected content. The vulnerability is addressed in Next.js versions 15.5.16 and 16.2.5. The CVSS 3.1 score is 7.5 (High), reflecting network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact.

This vulnerability allows attackers to bypass authorization checks in affected Next.js applications, potentially exposing protected content without proper authentication. The impact is limited to confidentiality as integrity and availability are not affected. Exploitation does not require privileges or user interaction and can be performed remotely over the network.

A fix is available in Next.js versions 15.5.16 and 16.2.5. Users should upgrade affected versions to these fixed releases to remediate the vulnerability. There is no indication from the vendor advisory that alternative mitigations or temporary workarounds are available or recommended.