CVE-2026-44574: Authorization Bypass in Next.js
Platform
nodejs
Component
nextjs
Fixed in
15.5.16
CVE-2026-44574 describes an authorization bypass vulnerability within Next.js, a popular React framework. This flaw allows attackers to circumvent middleware protections on dynamic routes by manipulating query parameters, potentially granting unauthorized access to sensitive data. The vulnerability impacts versions 15.4.0 through 16.2.4, and a fix is available in versions 15.5.16 and 16.2.5.
Impact and Attack Scenarios
The primary impact of CVE-2026-44574 is unauthorized access to protected resources within a Next.js application. Attackers can craft malicious query parameters that alter the dynamic route value seen by the application's pages, effectively bypassing middleware checks designed to enforce access control. This could lead to exposure of sensitive user data, administrative functions, or other restricted areas. The blast radius depends on the sensitivity of the protected routes and the potential for lateral movement within the application. A successful exploit could be particularly damaging if the application handles personally identifiable information (PII) or financial data.
Exploitation Context
CVE-2026-44574 was published on May 13, 2026. Its severity is rated HIGH with a CVSS score of 8.1. There are currently no public proof-of-concept (POC) exploits available, and no reports of active exploitation campaigns. The vulnerability is not listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog or has an EPSS score, suggesting a low to medium probability of exploitation in the near term.
Threat Intelligence
Exploit Status
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- Low — any valid user account is sufficient. Basic authenticated access required.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
Mitigation and Workarounds
The recommended mitigation for CVE-2026-44574 is to immediately upgrade Next.js to version 15.5.16 or 16.2.5. If upgrading is not immediately feasible, consider implementing stricter input validation and sanitization within your middleware functions to prevent query parameter manipulation. Review all dynamic routes protected by middleware and ensure that the logic correctly validates the route value. While not a direct fix, implementing a Web Application Firewall (WAF) with rules to detect and block suspicious query parameter patterns can provide an additional layer of defense. After upgrading, confirm the fix by attempting to access protected routes with crafted query parameters to verify that the middleware checks are functioning as expected.
How to fix
Actualice Next.js a la versión 15.5.16 o superior, o a la versión 16.2.5 o superior. Esta actualización corrige una vulnerabilidad de bypass de autorización en middleware que permite el acceso a contenido protegido sin la validación esperada.
Frequently asked questions
What is CVE-2026-44574 — Authorization Bypass in Next.js?
CVE-2026-44574 is a HIGH severity vulnerability in Next.js affecting versions 15.4.0–>= 16.0.0, < 16.2.5. It allows attackers to bypass middleware checks by manipulating query parameters, potentially accessing protected content.
Am I affected by CVE-2026-44574 in Next.js?
If you are using Next.js versions 15.4.0 through 16.2.4 and rely on middleware to protect dynamic routes, you are potentially affected by this vulnerability.
How do I fix CVE-2026-44574 in Next.js?
Upgrade Next.js to version 15.5.16 or 16.2.5. As a temporary workaround, implement stricter input validation in your middleware functions.
Is CVE-2026-44574 being actively exploited?
Currently, there are no public proof-of-concept exploits or reports of active exploitation campaigns related to CVE-2026-44574.
Where can I find the official Next.js advisory for CVE-2026-44574?
Refer to the official Next.js security advisory for CVE-2026-44574 on the Next.js GitHub repository or website (check for updates as the advisory may be published later).
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...