Next.js CVE-2026-44573
HIGH
GHSA-36qx-fr4f-26g5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3Blast Radius
ecosystem impact- 19 npm packages depend on next (17 direct, 2 indirect)
Ecosystem-wide dependent count for version 12.2.0.
DescriptionGitHub Advisory
Impact
Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks.
Fix
The matcher logic was updated to perform the same match as it would on a non-i18n data route.
Workarounds
If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.
AnalysisAI
Middleware bypass in Next.js Pages Router applications allows unauthenticated access to protected server-side rendered JSON data when i18n is configured. Attackers can retrieve SSR page data through locale-less /_next/data/<buildId>/<page>.json requests without triggering middleware authorization checks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Applications must use Next.js Pages Router (not App Router) with i18n internationalization configured in next.config.js and rely on middleware (middleware.js/ts) or upstream proxy for authorization instead of page-level data fetching guards. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.5 indicates high severity with critical exploitability factors: network vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a Next.js application with user dashboards protected by middleware authentication checks and i18n configured for multiple locales. The attacker bypasses authentication by directly requesting `/_next/data/BUILD_ID/dashboard.json` instead of navigating through the normal `/en/dashboard` route. … |
| Remediation | Upgrade to Next.js version 15.5.16 or 16.2.5 immediately. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all production Next.js applications and identify those running Pages Router with i18n enabled on versions 12.2.0-15.5.15 or 16.0.0-16.2.4; document business-critical applications and data sensitivity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today