CVE-2026-44573: Next.js: Middleware / Proxy bypass in Pages Router applications using i18n
Impact
Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks.
Fix The matcher logic was updated to perform the same match as it would on a non-i18n data route.
Workarounds
If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.
Other sources
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.2.5 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 15.5.16 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 15.5.16 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 16.2.5 - Compensating control
If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware, because middleware does not run for the unprefixed locale-less /_next/data/<buildId>/<page>.json route.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44573?
CVE-2026-44573 has a severity rating of 7.5, classified as high.
How do I fix CVE-2026-44573?
To mitigate CVE-2026-44573, ensure that middleware is correctly configured to handle locale-based requests in Pages Router applications.
What applications are affected by CVE-2026-44573?
Applications using the Pages Router with i18n configured and employing middleware-based authorization are affected by CVE-2026-44573.
What is the impact of CVE-2026-44573?
The impact of CVE-2026-44573 is unauthorized access to protected page data through specific locale-less requests.
When was CVE-2026-44573 published?
CVE-2026-44573 was published on May 11, 2026.