CVE-2026-44575

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Published

May 6, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

1.59% · Oct 25, 2026

A flaw was found in Next.js. App Router applications that use middleware or proxy-based authorization checks are vulnerable to unauthorized access. A remote attacker can exploit this by crafting specific .rsc and segment-prefetch URLs, which bypass the intended middleware rules. This allows access to protected content without proper authorization. next.js: Next.js: Unauthorized access to protected content via middleware bypass This is an Important flaw in Next.js App Router applications that utilize middleware or proxy-based authorization. A remote attacker can bypass these security checks by crafting specific URLs, leading to unauthorized access to protected content. This is due to transport-specific route variants used for segment prefetching not being consistently matched by middleware rules. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.