7.5
High
CVE-2026-44573 Next.js is a React framework for building full-stack web applications
Description
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| next.js 16.0 | 16.0.0 → < 16.2.5 | 16.2.5 |
| next.js 12.2 | 12.2.0 → < 15.5.16 | 15.5.16 |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat Trusted Artifact Signer | Versions not published | |
| streams for Apache Kafka 2 | Versions not published | |
| streams for Apache Kafka 3 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published |
Show the 4 other branches Hide the 4 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 9 | Versions not published | |
| Streams for Apache Kafka 2.9.4 | Versions not published | |
| Red Hat Trusted Artifact Signer 1.4 1783327185 | earliest → < 1783327185 | 1783327185 |
| Red Hat Trusted Artifact Signer 1.3 1783958622 | earliest → < 1783958622 | 1783958622 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of next.js
The 57 CVEs of next.js →
CVE-2026-94482
Next.js is a React framework for building full-stack web applications
8.2
High
CVE-2026-94484
Next.js is a React framework for building full-stack web applications
6.3
Medium
CVE-2026-94485
Next.js is a React framework for building full-stack web applications
6.3
Medium
CVE-2026-94483
Next.js is a React framework for building full-stack web applications
8.3
High