What is the CVSS score of CVE-2026-44573?

CVE-2026-44573 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Next.js are affected by CVE-2026-44573?

Next.js applications using Pages Router with i18n configuration are vulnerable to unauthorized data exposure through a middleware bypass affecting versions 12.2.0-15.5.15 and 16.0.0-16.2.4.. A patch is available.

Is there a public PoC exploit available for CVE-2026-44573?

Yes, a public proof-of-concept exploit is available for CVE-2026-44573. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-44573?

Within 24 hours: Inventory all production Next.js applications and identify those running Pages Router with i18n enabled on versions 12.2.0-15.5.15 or 16.0.0-16.2.4; document business-critical applications and data sensitivity. Within 7 days: Apply Vercel patches (upgrade to Next.js 15.5.16 or 16.2.5); validate middleware authorization functions are active post-upgrade through security testing. Within 30 days: Conduct forensic log review for unauthorized /_next/data/ requests in application access logs; perform penetration testing to confirm middleware enforcement; document remediation timeline and results.

Next.js CVE-2026-44573

HIGH

Incorrect Authorization (CWE-863)

2026-05-11 https://github.com/vercel/next.js

GHSA-36qx-fr4f-26g5

Authentication Bypass

7.5

CVSS 3.1 · Vendor: https://github.com/vercel/next.js

Severity by source

Vendor (https://github.com/vercel/next.js) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (https://github.com/vercel/next.js).

CVSS VectorVendor: https://github.com/vercel/next.js

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 11, 2026 - 16:15 vuln.today

Analysis Generated

May 11, 2026 - 16:15 vuln.today

CVE Published

May 11, 2026 - 15:53 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

19 npm packages depend on next (17 direct, 2 indirect)

Ecosystem-wide dependent count for version 12.2.0.

DescriptionCVE.org

Impact

Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks.

Fix

The matcher logic was updated to perform the same match as it would on a non-i18n data route.

Workarounds

If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.

AnalysisAI

Middleware bypass in Next.js Pages Router applications allows unauthenticated access to protected server-side rendered JSON data when i18n is configured. Attackers can retrieve SSR page data through locale-less /_next/data/<buildId>/<page>.json requests without triggering middleware authorization checks. This affects Next.js versions 12.2.0 through 15.5.15 and 16.0.0 through 16.2.4. Vercel released patches in versions 15.5.16 and 16.2.5 as part of a coordinated disclosure addressing multiple security issues. CVSS 7.5 (High) with network-accessible, low-complexity exploitation requiring no authentication. No public exploit code or CISA KEV listing identified at time of analysis.

Technical ContextAI

Next.js Pages Router with internationalization (i18n) configuration uses dynamic data routes at /_next/data/<buildId>/<page>.json to serve server-side rendered JSON for client-side navigation. These data routes normally match middleware patterns to enforce authorization. The vulnerability stems from CWE-863 (Incorrect Authorization) in the routing matcher logic: when i18n locales are configured, the framework failed to apply middleware checks to unprefixed (locale-less) data routes. Middleware only matched localized paths like /en/_next/data/... but not /_next/data/..., creating an authorization bypass. The affected packages are npm/next with CPE identifiers pkg:npm/next covering both the v15.x and v16.x branches. The fix updated matcher logic to treat non-i18n data routes identically to their localized counterparts, ensuring consistent middleware execution regardless of locale prefix presence.

RemediationAI

Upgrade to Next.js version 15.5.16 or 16.2.5 immediately. Release notes at https://github.com/vercel/next.js/releases/tag/v15.5.16 and https://github.com/vercel/next.js/releases/tag/v16.2.5 confirm the matcher logic fix. For npm installations, run npm install next@15.5.16 (for v15.x users) or npm install next@16.2.5 (for v16.x users). If immediate upgrade is blocked by compatibility testing requirements, implement defense-in-depth by moving authorization checks from middleware into the server-side data fetching functions themselves (getServerSideProps or API route handlers). This workaround incurs code duplication and performance overhead from redundant authorization logic execution but prevents the bypass by enforcing checks regardless of routing path. Note this compensating control requires careful implementation across all protected pages and does not address the root cause. The upgrade path is strongly preferred as Vercel addressed 11 concurrent security issues in these releases, making the patch particularly critical.