---
id: "CVE-2026-44575"
kind: "vulnerability"
aliases: ["CVE-2026-44575"]
title: "Next.js: middleware bypass lets unauthenticated requests skip authorization checks"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "vercel next.js", "fixed": ["15.5.16"], "affected": ">= 15.2.0, < 15.5.16", "ecosystem": "vendor"}, {"name": "vercel next.js", "fixed": ["16.2.5"], "affected": ">= 16.0.0, < 16.2.5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cloudflare", "lab-disclosure", "next.js", "react", "runtime", "self-hosted", "vercel"]
not_affected_if: ["auth-in-route-code", "pages-router-only", "static-export"]
published_at: "2026-05-07T18:56:04+00:00"
first_seen_at: "2026-10-24T18:56:54+00:00"
updated_at: "2026-10-25T05:29:50+00:00"
sources: [{"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-05-07-emergency-waf-release/", "first_seen_at": "2026-10-24T18:56:54+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44575", "first_seen_at": "2026-10-24T19:23:38+00:00"}]
---

# Next.js: middleware bypass lets unauthenticated requests skip authorization checks

Next.js App Router applications can be tricked into skipping middleware or proxy authorization checks through segment-prefetch routes. An unauthenticated attacker can reach protected pages and possibly the sensitive data they serve.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:vercel next.js affected >= 15.2.0, < 15.5.16 fixed 15.5.16
- vendor:vercel next.js affected >= 16.0.0, < 16.2.5 fixed 16.2.5

## How to check

- Run `npx next --version` in the app and compare against the fixed versions: `15.5.16` for the 15.x line, `16.2.5` for the 16.x line.
- Check that the app uses the App Router and relies on middleware or proxy files for authorization.

## Fix

- Upgrade Next.js to `15.5.16` (15.x line) or `16.2.5` (16.x line) or later.
- If an upgrade cannot happen now, enforce authorization inside the route or page logic instead of relying only on middleware.

## Timeline

- 2026-10-24T18:56:54+00:00 lab https://developers.cloudflare.com/changelog/post/2026-05-07-emergency-waf-release/ — Cloudflare: WAF Release - 2026-05-07 - Emergency · Changelog
- 2026-10-24T19:23:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-44575

## Documents

- [advisory] Cloudflare: WAF Release - 2026-05-07 - Emergency · Changelog https://developers.cloudflare.com/changelog/post/2026-05-07-emergency-waf-release/

## From the sources

WAF Release - 2026-05-07 - Emergency · Changelog

# Changelog

New updates and improvements at Cloudflare.

May 7, 2026

## WAF Release - 2026-05-07 - Emergency

This emergency release introduces a new rule to detect Next.js App Router middleware and proxy bypass attempts via segment-prefetch routes (CVE-2026-44575).

Key Findings

CVE-2026-44575: Next.js Middleware / Proxy Bypass in App Router Applications via Segment-Prefetch Routes

Successful exploitation allows unauthenticated attackers to bypass middleware or proxy-based authorization checks in affected Next.js App Router applications. This leads to unauthorized access to protected content, potential exposure of sensitive application data, and compromise of application security boundaries.

We strongly recommend upgrading to Next.js 15.5.16 or 16.2.5 (or later) immediately to address the underlying vulnerability. If you cannot upgrade immediately, enforce authorization in the underlying route or page logic instead of relying solely on middleware.

| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
| --- | --- | --- | --- | --- | --- | --- |
| Cloudflare Managed Ruleset | ...e77e4a53 | N/A | Next.js - Middleware Bypass via Invalid RSC Header - CVE:CVE-2026-44575 | N/A | Disabled | This is a new detection. |

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_