REDHAT-BUG-2477199: High severity Next.js Next.js vulnerability

Q: Which applications are exposed to this issue?

Applications are affected only if they use the Pages Router, have i18n configured, and rely on middleware or a proxy for authorization. The exposure is unauthorized retrieval of SSR JSON page data through locale-less /_next/data/<buildId>/<page>.json requests.

Published May 13, 2026

Updated

Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.

Affected Software

1 affected component

Next.js Next.js>=12.2.0<15.5.16, >=16.2.5<16.2.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.5.16
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.2.5

Event History

May 13, 2026

Data Sourced

via Red Hat·06:02 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications are affected only if they use the Pages Router, have i18n configured, and rely on middleware or a proxy for authorization. The exposure is unauthorized retrieval of SSR JSON page data through locale-less /_next/data/<buildId>/<page>.json requests.

What does an attacker need to exploit it?

An attacker needs to request an unprefixed, locale-less Next.js data route for a protected page. In the affected configuration, that route bypasses the middleware authorization check and can return the page's SSR JSON data.

How can I determine whether my deployment is affected?

Check whether the application uses a Next.js version from 12.2.0 through versions before 15.5.16 or 16.2.5, uses the Pages Router with i18n, and enforces access control through middleware or a proxy. Test whether a locale-less /_next/data/<buildId>/<page>.json request for a protected page returns data without the expected authorization checks.

What versions contain the fix?

The issue is fixed in Next.js 15.5.16 and 16.2.5.

REDHAT-BUG-2477199: High severity Next.js Next.js vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

How can I determine whether my deployment is affected?

What versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

How can I determine whether my deployment is affected?

What versions contain the fix?