CVE-2026-44575: high-severity vulnerability in vercel next.js
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Next.js App Router has a flaw where special URLs used for prefetching page segments can bypass security checks meant to protect content, allowing unauthorized users to access restricted pages that should require permission.
The vulnerability exists in Next.js 15.2.0 through 15.5.15 and 16.0.0 through 16.2.4, where segment-prefetch and .rsc route variants resolve to protected resources without matching middleware authorization rules. An attacker can craft requests to these transport-specific URLs to access content protected by middleware or proxy-based authorization, circumventing the intended access control.
In the same product, most dangerous first.