Introduction
A middleware authorization bypass in Next.js lets unauthenticated attackers silently retrieve protected server-side rendered page data from any application that uses the Pages Router with internationalization enabled. For organizations that rely on Next.js middleware as their authorization boundary, confidential page content such as user dashboards, admin panels, and internal data views may already be accessible to anyone who knows the right URL pattern.
Technical Information
Root Cause: The Matcher Logic Gap
The vulnerability comes from how Next.js resolves data-fetching requests internally when the Pages Router runs with an i18n configuration. During normal client-side navigation, Next.js fetches page data from internal JSON endpoints that follow the pattern /_next/data/<buildId>/<locale>/<page>.json. The framework's middleware matcher translates these internal paths back to their logical page paths, so middleware route patterns can evaluate them and enforce authorization.
The flaw is specific to i18n configurations. When i18n is enabled, the matcher expects data route requests to include a locale prefix (e.g., /en/, /fr/). A request like /_next/data/<buildId>/en/dashboard.json resolves correctly to the logical page /dashboard, middleware fires, and authorization checks run as intended.
The matcher did not recognize requests that omit the locale prefix. A request to /_next/data/<buildId>/dashboard.json (without the /en/ segment) fell straight through the matching logic, because the matcher did not treat the unprefixed data route as belonging to a page that should trigger middleware. The server happily returned the full SSR JSON payload without ever running middleware, which meant no authorization check ran either.
The bug is classified as CWE-863 (Incorrect Authorization), and the label fits, because the authorization mechanism exists but does not apply to a reachable code path.
Attack Flow
Exploitation is direct. It needs no authentication, no user interaction, and no specialized tooling:
-
The attacker finds a Next.js application that uses the Pages Router with i18n enabled. Locale-prefixed URLs in the application's navigation (e.g.,
/en/dashboard,/fr/settings) often give this away. -
The attacker gets the application's current build ID, which is typically exposed in page source, static assets, or earlier
/_next/data/responses seen during normal browsing. -
The attacker requests the target page's data endpoint and deliberately leaves out the locale prefix:
GET /_next/data/<buildId>/dashboard.jsonInstead of the expected locale-prefixed form:
GET /_next/data/<buildId>/en/dashboard.json -
Because the middleware matcher does not recognize the locale-less data route, middleware never executes. The server treats the request as a valid data fetch and returns the complete SSR JSON response for the
/dashboardpage. -
The attacker receives the same JSON payload an authenticated, authorized user would get during a client-side page transition. It contains every prop returned by
getServerSidePropsor an equivalent server-side data-fetching function.
Exploitability Profile
The CVSS v3.1 metrics look like this:
| Metric | Value | Context |
|---|---|---|
| Attack Vector | Network | Exploitable remotely over the internet |
| Attack Complexity | Low | No specialized conditions required |
| Privileges Required | None | Unauthenticated attackers can exploit this |
| User Interaction | None | Fully automatable |
| Confidentiality Impact | High | Direct access to protected SSR JSON data |
| Integrity Impact | None | No data modification possible |
| Availability Impact | None | Application remains operational |
The vulnerability scores 7.5. Because it is reachable over the network, needs no authentication, and has high confidentiality impact, it is particularly well suited to automated, large-scale data harvesting against internet-facing applications.
Patch Information
Vercel fixed CVE-2026-44573 in a coordinated Next.js security release on May 6 through 7, 2026, which shipped fixes for 13 advisories at once. The fix for this vulnerability first appeared in Next.js v15.5.16 (for the 15.x line) and Next.js v16.2.5 (for the 16.x line). A later release, v16.2.6, also carries the fix, along with a follow-up correction for a separate advisory.
What the Fix Changes
The core change makes the middleware matcher apply the same route matching to locale-less /_next/data/ requests that it applies to a standard non-i18n data route. In practice, the framework now normalizes the incoming data route URL the same way whether or not a locale prefix is present, and only then evaluates it against middleware route patterns. After the patch, both /_next/data/<buildId>/en/dashboard.json and /_next/data/<buildId>/dashboard.json resolve to the logical page /dashboard and trigger middleware, which closes the bypass.
The exact commit that implements the fix has not been disclosed in the public advisory or the release notes. That is typical for security patches in coordinated releases, where diffs are merged privately before a release is tagged.
Upgrade Commands
According to Vercel's official changelog, the latest recommended upgrade targets are v15.5.18 and v16.2.6, which bundle all fixes from the May 2026 coordinated release:
# For 15.x projects (recommended latest): npm install [email protected] # For 16.x projects (recommended latest): npm install [email protected]
Workaround for Teams Unable to Upgrade
For organizations that cannot upgrade right away, the recommended structural workaround is to move authorization checks into the page's server-side data path (e.g., inside getServerSideProps) instead of relying only on middleware. That way authorization is enforced no matter how the request reaches the page handler.
Vercel explicitly noted that no WAF rules were deployed for this vulnerability, because the advisory class cannot be reliably blocked at the WAF layer. The only complete resolution is to upgrade the framework itself.
Affected Systems and Versions
The affected range spans nearly four years of Next.js releases:
| Branch | Affected Versions | Fixed Version |
|---|---|---|
| 12.x through 15.x | 12.2.0 through 15.5.15 | 15.5.16 (recommended: 15.5.18) |
| 16.x | 16.0.0 through 16.2.4 | 16.2.5 (recommended: 16.2.6) |
The vulnerability requires:
- The Pages Router (not the App Router)
- Internationalization (i18n) configured in
next.config.js - Middleware or proxy-based authorization as the primary access control mechanism for protected pages
Applications using the App Router, and Pages Router applications without an i18n configuration, are not affected by this particular vulnerability.
Vendor Security History
Vercel's May 2026 coordinated release fixed thirteen separate security advisories in a single window, covering middleware bypasses, denial-of-service vulnerabilities, server-side request forgery, cache poisoning, and cross-site scripting. That many concurrent fixes across that many vulnerability classes suggests Next.js either went through a significant security audit or received a cluster of related reports in a short period. Rolling every fix into versions 15.5.18 and 16.2.6 shows a responsive security team. It is also a good argument for keeping automated dependency update pipelines running on any project built on Next.js.
References
- CVE-2026-44573 NVD Record
- GHSA-36qx-fr4f-26g5: Vercel Security Advisory
- GHSA-36qx-fr4f-26g5: GitHub Advisory Database
- Next.js v15.5.16 Release
- Next.js v16.2.5 Release
- Next.js v16.2.6 Release
- Vercel Changelog: Next.js May 2026 Security Release
- dwisiswant0: Next.js v16.2.4 Security PoC Collection
- Cloudflare: WAF and Framework Adapter Mitigations for React and Next.js
