CVE-2026-44575 Details
Description
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.
A vulnerability exists in Vercel Next.js versions 15.2.0 prior to 15.5.16 and 16.0.0 prior to 16.2.5, allowing unauthorized access in App Router applications that depend on middleware or proxy-based authorization checks. The issue arises from transport-specific route variants used for segment prefetching, which can bypass intended middleware rules. In affected setups, specially crafted .rsc and segment-prefetch URLs may resolve to the same page without triggering the necessary authorization checks, potentially exposing protected content.
Users can upgrade to Next.js versions 15.5.16 or 16.2.5 to address this vulnerability. If an immediate upgrade is not possible, authorization can be enforced in the underlying route or page logic instead of relying solely on middleware.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:34608 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:37272 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:40974 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:54435 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-44575 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477188 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44575.json | redhat-SADP | |
| https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | [email protected] |
| CWE-551 | Incorrect Behavior Order: Authorization Before Parsing and Canonicalization | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| vercel next.js | >= 15.2.0, < 15.5.16 >= 16.0.0, < 16.2.5 |
CPE
Remediation
| |
Change History
12 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 13, 2026 | CVE Modified | redhat-SADP |
| Jul 31, 2026 | CVE Modified | redhat-SADP |
| Jul 30, 2026 | CVE Modified | redhat-SADP |
| Jul 16, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 10, 2026 | CVE Modified | redhat-SADP |
| Jul 3, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |