{"id":"CVE-2026-44575","kind":"vulnerability","aliases":["CVE-2026-44575"],"related":[],"title":"Next.js: middleware bypass lets unauthenticated requests skip authorization checks","description":"WAF Release - 2026-05-07 - Emergency · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nMay 7, 2026\n\n## WAF Release - 2026-05-07 - Emergency\n\nThis emergency release introduces a new rule to detect Next.js App Router middleware and proxy bypass attempts via segment-prefetch routes (CVE-2026-44575).\n\nKey Findings\n\nCVE-2026-44575: Next.js Middleware / Proxy Bypass in App Router Applications via Segment-Prefetch Routes\n\nSuccessful exploitation allows unauthenticated attackers to bypass middleware or proxy-based authorization checks in affected Next.js App Router applications. This leads to unauthorized access to protected content, potential exposure of sensitive application data, and compromise of application security boundaries.\n\nWe strongly recommend upgrading to Next.js 15.5.16 or 16.2.5 (or later) immediately to address the underlying vulnerability. If you cannot upgrade immediately, enforce authorization in the underlying route or page logic instead of relying solely on middleware.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...e77e4a53 | N/A | Next.js - Middleware Bypass via Invalid RSC Header - CVE:CVE-2026-44575 | N/A | Disabled | This is a new detection. |","summary":"Next.js App Router applications can be tricked into skipping middleware or proxy authorization checks through segment-prefetch routes. An unauthenticated attacker can reach protected pages and possibly the sensitive data they serve.","severity":"high","cvss":7.5,"epss":0.00761,"exploited":false,"exploited_at":null,"products":[{"name":"vercel next.js","fixed":["15.5.16"],"affected":">= 15.2.0, < 15.5.16","ecosystem":"vendor"},{"name":"vercel next.js","fixed":["16.2.5"],"affected":">= 16.0.0, < 16.2.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","lab-disclosure","next.js","react","runtime","self-hosted","vercel"],"not_affected_if":["auth-in-route-code","pages-router-only","static-export"],"how_to_check":"- Run `npx next --version` in the app and compare against the fixed versions: `15.5.16` for the 15.x line, `16.2.5` for the 16.x line.\n- Check that the app uses the App Router and relies on middleware or proxy files for authorization.","fix":"- Upgrade Next.js to `15.5.16` (15.x line) or `16.2.5` (16.x line) or later.\n- If an upgrade cannot happen now, enforce authorization inside the route or page logic instead of relying only on middleware.","status":"open","published_at":"2026-05-07T18:56:04+00:00","first_seen_at":"2026-10-24T18:56:54+00:00","triaged_at":"2026-10-25T05:29:50+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T05:29:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Next.js to `15.5.16` (15.x line) or `16.2.5` (16.x line) or later.\n- If an upgrade cannot happen now, enforce authorization inside the route or page logic instead of relying only on middleware.","reach":"internet","title":"Next.js: middleware bypass lets unauthenticated requests skip authorization checks","impact":"high","summary":"Next.js App Router applications can be tricked into skipping middleware or proxy authorization checks through segment-prefetch routes. An unauthenticated attacker can reach protected pages and possibly the sensitive data they serve.","category":"runtime","nicknames":[],"who_cares":["next.js","self-hosted","vercel","react"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated users reach protected pages and read sensitive application data","analyst_note":"Confirm the exact trigger and whether Vercel-hosted apps need extra action; see the Next.js advisory linked from NVD for details.","how_to_check":"- Run `npx next --version` in the app and compare against the fixed versions: `15.5.16` for the 15.x line, `16.2.5` for the 16.x line.\n- Check that the app uses the App Router and relies on middleware or proxy files for authorization.","needs_analyst":true,"not_affected_if":["static-export","auth-in-route-code","pages-router-only"],"who_is_affected":"Applications on Next.js 15.2.0 up to but not including 15.5.16, and 16.0.0 up to but not including 16.2.5, that use the App Router and gate protected content with middleware or proxy checks. Apps on other versions, apps without middleware-based authorization, and apps that already enforce auth in route or page code are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":3885,"output_tokens":640,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-05':67C,84C '-07':68C,85C '-2026':11A,14A,110C,115C,233C '-44575':12A,15A,111C,116C,234C '15.5.16':176C '16.2.5':178C '2026':66C,80C,83C '7':79C 'access':154C 'action':215C,217C 'address':183C 'affect':145C 'allow':132C 'app':32B,97C,122C,147C 'applic':34B,124C,149C,162C,167C 'attack':52B,134C 'attempt':103C 'author':8A,43B,142C,193C 'base':141C 'boundari':169C 'bypass':3A,102C,120C,136C,226C 'cannot':189C 'changelog':70C,71C 'check':9A,44B,143C 'cloudflar':20B,77C,219C 'comment':218C 'compromis':165C 'content':157C 'cve':10A,13A,109C,114C,231C,232C 'data':61B,163C 'descript':213C 'detect':95C,241C 'disabl':236C 'disclosur':23B 'e77e4a53':222C 'emerg':69C,86C,88C 'enforc':192C 'exploit':131C 'exposur':159C 'find':113C 'header':230C 'host':29B 'id':209C,212C 'immedi':181C,191C 'improv':75C 'instead':201C 'introduc':90C 'invalid':228C 'key':112C 'lab':22B 'lab-disclosur':21B 'later':180C 'lead':151C 'legaci':210C 'let':4A 'logic':200C 'manag':220C 'may':78C 'middlewar':2A,40B,99C,118C,137C,206C,225C 'n/a':223C,235C 'new':72C,92C,216C,240C 'next.js':1A,17A,19A,24B,31B,96C,117C,146C,175C,224C 'page':56B,199C 'possibl':58B 'potenti':158C 'prefetch':48B,107C,128C 'previous':214C 'protect':55B,156C 'proxi':42B,101C,119C,140C 'proxy-bas':139C 'reach':54B 'react':25B 'recommend':172C 'releas':65C,82C,89C 'reli':203C 'request':6A 'rout':49B,108C,129C,197C 'router':33B,98C,123C,148C 'rsc':229C 'rule':93C,208C,211C 'ruleset':207C,221C 'runtim':26B 'secur':168C 'segment':47B,106C,127C 'segment-prefetch':46B,105C,126C 'self':28B 'self-host':27B 'sensit':60B,161C 'serv':63B 'skip':7A,39B 'sole':204C 'strong':171C 'success':130C 'trick':37B 'unauthent':5A,51B,133C 'unauthor':153C 'under':185C,196C 'updat':73C 'upgrad':173C,190C 'vercel':16A,18A,30B 'via':104C,125C,227C 'vulner':186C 'waf':64C,81C","nicknames":[],"mitigations":[],"who_affected":"Applications on Next.js 15.2.0 up to but not including 15.5.16, and 16.0.0 up to but not including 16.2.5, that use the App Router and gate protected content with middleware or proxy checks. Apps on other versions, apps without middleware-based authorization, and apps that already enforce auth in route or page code are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-05-07T18:56:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-05-07-emergency-waf-release/#CVE-2026-44575","url":"https://developers.cloudflare.com/changelog/post/2026-05-07-emergency-waf-release/","severity":null,"published_at":"2026-05-07T18:56:04+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:56:54+00:00","fetched_at":"2026-10-24T18:56:54+00:00","note":"Cloudflare: WAF Release - 2026-05-07 - Emergency · Changelog"},{"source":"nvd","external_id":"CVE-2026-44575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44575","severity":null,"published_at":"2026-05-13T17:16:22+00:00","modified_at":"2026-08-13T13:19:03+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","fetched_at":"2026-10-24T19:23:38+00:00","note":null},{"source":"epss","external_id":"CVE-2026-44575","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-44575","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2907,"url":"https://developers.cloudflare.com/changelog/post/2026-05-07-emergency-waf-release/","title":"Cloudflare: WAF Release - 2026-05-07 - Emergency · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-05-07 - Emergency · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nMay 7, 2026\n\n## WAF Release - 2026-05-07 - Emergency\n\nThis emergency release introduces a new rule to detect Next.js App Router middleware and proxy bypass attempts via segment-prefetch routes (CVE-2026-44575).\n\nKey Findings\n\nCVE-2026-44575: Next.js Middleware / Proxy Bypass in App Router Applications via Segment-Prefetch Routes\n\nSuccessful exploitation allows unauthenticated attackers to bypass middleware or proxy-based authorization checks in affected Next.js App Router applications. This leads to unauthorized access to protected content, potential exposure of sensitive application data, and compromise of application security boundaries.\n\nWe strongly recommend upgrading to Next.js 15.5.16 or 16.2.5 (or later) immediately to address the underlying vulnerability. If you cannot upgrade immediately, enforce authorization in the underlying route or page logic instead of relying solely on middleware.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...e77e4a53 | N/A | Next.js - Middleware Bypass via Invalid RSC Header - CVE:CVE-2026-44575 | N/A | Disabled | This is a new detection. |","published_at":"2026-05-07T18:56:04+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}