CVE-2026-44574: Next.js: Middleware / Proxy bypass through dynamic route parameter injection
Impact
Applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check.
Fix
We now only honor internal route-parameter normalization in trusted routing flows and ignore externally supplied parameter encodings that should never have been accepted from ordinary requests.
Workarounds
If you cannot upgrade immediately, enforce authorization in route or page logic instead of relying solely on middleware path matching.
Other sources
Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 15.5.16 and 16.2.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.2.5 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 15.5.16 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 15.5.16 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 16.2.5 - Configuration
If you cannot upgrade immediately, enforce authorization in route or page logic instead of relying solely on middleware path matching; additionally ensure externally supplied parameter encodings that could inject/alter dynamic route parameters are ignored while only internal normalization is honored in trusted routing flows.
Next.js middleware/proxy route handling Route-parameter normalization trust boundary = Only honor internal route-parameter normalization in trusted routing flows; ignore externally supplied parameter encodings from ordinary requests
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44574?
CVE-2026-44574 has been classified with a critical severity due to its potential to allow unauthorized access.
How do I fix CVE-2026-44574?
To mitigate CVE-2026-44574, upgrade to Next.js version 16.2.5 or 15.5.16.
What applications are affected by CVE-2026-44574?
CVE-2026-44574 affects Next.js applications that utilize middleware for dynamic route protection.
What type of vulnerability is CVE-2026-44574?
CVE-2026-44574 is an authorization bypass vulnerability that can be exploited through dynamic route parameter injection.
Who is the vendor associated with CVE-2026-44574?
The vendor associated with CVE-2026-44574 is Vercel, the company behind Next.js.