CoreCVE
Back

HIGH

Next.js: Middleware / Proxy bypass in Pages Router applications using i18n

Published May 13, 2026

Description

Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.

Affected products

Remediation

Red Hat statement

Important: A flaw in Next.js applications allows unauthorized access to sensitive server-side rendered (SSR) JSON data by bypassing middleware authorization checks. This occurs when applications use the Pages Router with internationalization (i18n) and middleware or proxy-based authorization, enabling remote attackers to retrieve protected page data through locale-less requests.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (2)

CWE-551

CWE-863

Incorrect Authorization

References (13)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published May 13, 2026
Updated Aug 13, 2026
Reserved May 6, 2026
Link CVE-2026-44573
CISA Vulnrichment
Updated May 13, 2026
NVD
Status Modified
Modified Aug 13, 2026
Link CVE-2026-44573
Red Hat
Severity Important
Public date May 13, 2026
Links CVE-2026-44573 - Bugzilla
GHSA-36QX-FR4F-26G5