Next.js CVE-2026-44574: Middleware Authorization Bypass via Dynamic Route Parameter Injection — Technical Analysis with PoC

Introduction

On May 6, 2026, Vercel shipped a coordinated security release that patched thirteen advisories across Next.js and React Server Components. One of the most serious was CVE-2026-44574, a middleware authorization bypass. It lets attackers smuggle internal routing parameters into ordinary HTTP requests and render protected dynamic route content without passing any middleware checks. If your Next.js application gates dynamic routes like /dashboard/[userId] or /admin/[slug] through middleware alone, this vulnerability renders those guards ineffective.

Technical Information

Root Cause: Trust Boundary Mismatch Between Middleware and the App Router

Next.js uses reserved query parameters internally to track matched dynamic segments during routing. Parameters prefixed with nxtP represent path segment values (for example, nxtPslug for a [slug] dynamic segment), and parameters prefixed with nxtI represent intercept route markers. Only the framework's own internal routing engine and prefetch mechanisms are meant to set these.

In vulnerable versions, the App Router trusts these parameters unconditionally when they appear in incoming HTTP requests, and uses them to build the params object passed to the page handler. Middleware, meanwhile, only inspects request.nextUrl.pathname to make authorization decisions. The two fall out of sync:

1. Middleware evaluates the visible URL path and decides whether to allow or block the request.
2. The App Router resolves the page using injected nxtP* parameters, which can point to a completely different dynamic route value than the pathname suggests.

Because the two components disagree on what the request actually targets, an attacker can craft a request where the pathname points to a public, unprotected route while the injected parameters direct the page handler to render protected content.

Attack Flow

The attack runs along two arms, both exploiting the same desynchronization.

Arm A: nxtP* Parameter Smuggling

The attacker sends a request to a known public path such as /safe, injecting the internal nxtPslug query parameter to target a protected dynamic route:

curl -k -s -i \
  -H 'x-matched-path: /admin/[slug]' \
  -H 'x-now-route-matches: 1=secret-page' \
  "${TARGET}/safe?nxtPslug=secret-page&__nextDefaultLocale=&__nextLocale="

Middleware sees pathname = /safe, a public route, so no authorization check fires. The App Router resolves the request using the injected nxtPslug parameter and invokes the handler for /admin/[slug] with params = { slug: "secret-page" }. The protected page renders with no authorization.

Arm B: Double Encoded Slash Mismatch

The attacker sends a request with a double encoded slash in the dynamic segment:

curl -k -s -i --path-as-is "${TARGET}/admin/foo%252Fsecret-page"

The pre patch client parameter parser runs encodeURIComponent on already encoded pathname parts, so /admin/foo%252Fbar round trips differently between the client and server. Middleware sees one segment value while the page handler decodes it to foo/secret-page. Each side takes a different code branch, and the authorization check is bypassed again.

In both arms, the exploit confirms success by checking for an HTTP 200 response that contains a sentinel string (ADMIN_SECRET_FLAG) in the body, which proves the protected page rendered.

CWE Classification

This vulnerability falls under CWE-288 (Authentication Bypass Using an Alternate Path or Channel), which describes the core issue: the attacker reaches a protected resource through a routing path the authentication mechanism does not cover.

Proof of Concept

A public, runnable proof of concept collection is available in the dwisiswant0/next-16.2.4-pocs GitHub repository (127 stars, 25 forks as of mid May 2026). The CVE-2026-44574 materials sit under poc/CVE-2026-44574_GHSA-492v-c6pp-mqqv/ and include:

• exploit.sh: a bash script demonstrating both the nxtP* parameter smuggling (Arm A) and the double encoded slash mismatch (Arm B)
• exploit.py: a Python implementation of the same logic
• CVE-2026-44574.yaml: a Nuclei template for automated scanning
• A vulnerable sample application for local reproduction

You can run the Nuclei template directly against a target:

nuclei -u <target_url> -t poc/CVE-2026-44574_GHSA-492v-c6pp-mqqv/CVE-2026-44574.yaml

The exploit scripts target the nxtPslug parameter injection and the double encoding mismatch, checking for the ADMIN_SECRET_FLAG sentinel in the response to confirm a successful bypass. Because these tools were public immediately, the window between disclosure and exploitation is effectively zero.

Patch Information

Vercel addressed CVE-2026-44574 in the coordinated May 6, 2026 security release. The advisory, tracked as GHSA-492v-c6pp-mqqv, was published by Next.js maintainer timneutkens.

Patched versions:

The fix tightens the trust boundary around route parameter resolution. Next.js now honors internal route parameter normalization only in trusted routing flows, which means the internal routing engine and prefetch mechanisms are the only sources allowed to supply encoded route parameters. Any externally supplied parameter encodings that arrive in plain HTTP requests are ignored and discarded before they can influence dynamic segment resolution. The upstream commit f1c11203d5 normalizes encoded pathname parts on the client so they round trip identically with the server's encodeURIComponent(decoded) form, closing the gap.

Because this was a security sensitive change, the commits were prepared in a private fork and merged directly into the release tags without individual public pull request numbers. The fix shipped alongside 11 other advisories in the same batch.

Interim workaround: For teams that cannot upgrade right away, the advisory recommends moving authorization checks into route level or page level logic rather than relying on middleware path matching as the security gate.

Important WAF note: Both Vercel and Cloudflare have confirmed that WAF rules cannot reliably block this attack vector. Vercel states that patching is the only complete mitigation, and Cloudflare notes that it is not possible to safely enable a generic managed rule for this class of vulnerability. Framework upgrades are required.

Affected Systems and Versions

The following Next.js versions are vulnerable:

• Next.js 15.x: versions 15.4.0 through 15.5.15 (inclusive)
• Next.js 16.x: versions 16.0.0 through 16.2.4 (inclusive)

The vulnerability affects applications that:

1. Use the App Router (not the legacy Pages Router for this specific attack path)
2. Rely on middleware to enforce authorization on dynamic routes, such as /admin/[slug] or /dashboard/[userId]
3. Do not add redundant authorization checks at the page or route handler level

Applications are affected on any hosting platform, including Vercel, Cloudflare Pages, Netlify, and self hosted environments. Netlify has noted that users on Pages Router with i18n should also upgrade the Netlify plugin.

Vendor Security History

The May 2026 coordinated release patched thirteen advisories at once across Next.js and React Server Components: six rated High severity, four Moderate, and two Low. That many routing and middleware bypass issues in a single batch shows how hard it is to secure the boundary between middleware, routing, and rendering in modern server side rendering frameworks. Next.js has had middleware bypass vulnerabilities before, and this desynchronization between middleware path evaluation and backend route resolution is a recurring attack surface in the framework's architecture.

References

• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• CVE Record: CVE-2026-44574
• GitHub Advisory: GHSA-492v-c6pp-mqqv
• Next.js May 2026 Security Release (Vercel Changelog)
• Next.js v16.2.5 Release
• Next.js v15.5.16 Release
• dwisiswant0/next-16.2.4-pocs: PoC Collection
• PoC README for CVE-2026-44574
• PoC exploit.sh for CVE-2026-44574
• Cloudflare: WAF and Framework Adapter Mitigations for React and Next.js
• Netlify: Security Update for Next.js and React Vulnerabilities
• TheCybrDef: 12 Next.js Flaws Exposed
• Eventus Security: Next.js Vulnerabilities Impact Identity Verification and Request Routing