CVE-2026-44573
Next.js is a React framework for building full-stack web applications.
Published May 13, 2026 · updated Aug 13, 2026 · vercel next.js
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/ / .json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 13, 2026 · NIST NVD
Detected
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/ / .json requests. In affected configurations, middleware does not run for the unprefixed data route, al
Aug 13, 2026 · NIST NVD
Updated
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/ / .json requests. In affected configurations, middleware does not run for the unprefixed data route, al
Affected
- cpe vercel/next.jsversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-44573
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-44573
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-l
nvd.nist.gov