Live › vulnerability › CVE-2026-44575
Go to dashboardNext.js App Router applications can be tricked into skipping middleware or proxy authorization checks through segment-prefetch routes. An unauthenticated attacker can reach protected pages and possibly the sensitive data they serve.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:56 UTC, 0h before NVD. All times on this page are UTC.
Applications on Next.js 15.2.0 up to but not including 15.5.16, and 16.0.0 up to but not including 16.2.5, that use the App Router and gate protected content with middleware or proxy checks. Apps on other versions, apps without middleware-based authorization, and apps that already enforce auth in route or page code are less exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vercel next.js | vendor | >= 15.2.0, < 15.5.16 | 15.5.16 |
| vercel next.js | vendor | >= 16.0.0, < 16.2.5 | 16.2.5 |
npx next --version in the app and compare against the fixed versions: 15.5.16 for the 15.x line, 16.2.5 for the 16.x line.15.5.16 (15.x line) or 16.2.5 (16.x line) or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-05-07 - Emergency · Changelog
New updates and improvements at Cloudflare.
May 7, 2026
This emergency release introduces a new rule to detect Next.js App Router middleware and proxy bypass attempts via segment-prefetch routes (CVE-2026-44575).
Key Findings
CVE-2026-44575: Next.js Middleware / Proxy Bypass in App Router Applications via Segment-Prefetch Routes
Successful exploitation allows unauthenticated attackers to bypass middleware or proxy-based authorization checks in affected Next.js App Router applications. This leads to unauthorized access to protected content, potential exposure of sensitive application data, and compromise of application security boundaries.
We strongly recommend upgrading to Next.js 15.5.16 or 16.2.5 (or later) immediately to address the underlying vulnerability. If you cannot upgrade immediately, enforce authorization in the underlying route or page logic instead of relying solely on middleware.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...e77e4a53 | N/A | Next.js - Middleware Bypass via Invalid RSC Header - CVE:CVE-2026-44575 | N/A | Disabled | This is a new detection. |
This page as .md · .json · in your agent: get_signal("CVE-2026-44575")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.