CVE-2026-44574: Authorization Bypass in Next.js

An attacker exploiting this vulnerability could bypass middleware authentication and authorization checks within Next.js applications. This means they could potentially access sensitive data or functionality that is normally protected by the application's security measures. The impact is particularly severe for applications heavily reliant on middleware for route protection, as the entire security model for those routes could be compromised. Successful exploitation could lead to unauthorized data access, modification, or even complete control of affected application features. This vulnerability shares similarities with other query parameter manipulation attacks, where seemingly innocuous URL parameters are leveraged to bypass security controls.

1. Reserviert2026-05-06
2. Veröffentlicht2026-05-13

The primary mitigation for CVE-2026-44574 is to upgrade to Next.js version 15.5.16 or 16.2.5, which contain the fix. If upgrading immediately is not feasible, consider implementing stricter input validation and sanitization on query parameters within your middleware functions. This can help prevent malicious values from being processed. Additionally, review your middleware logic to ensure it correctly handles and validates all relevant query parameters. After upgrading, confirm the fix by attempting to access protected routes with crafted query parameters designed to bypass the middleware; the request should be denied.