Executive brief
Next.js is a popular React web framework used to build modern applications. In applications using Next.js Pages Router with internationalization support, a security weakness allows attackers to bypass authorization checks by accessing protected page data through a direct URL pattern that middleware does not monitor. This can expose sensitive server-rendered data to unauthorized users, potentially leading to disclosure of customer information, business logic, or other confidential details that the page was meant to protect.
Technical details
This vulnerability is an authorization bypass (CWE-863) affecting Next.js Pages Router applications configured with i18n. The root cause is that middleware matcher logic does not properly handle locale-less data route requests to /_next/data/<buildId>/<page>.json. When i18n is enabled, middleware is expected to enforce authorization on all page accesses; however, the unprefixed (locale-less) data route bypasses this check, allowing an attacker to retrieve server-side rendered JSON for protected pages without authentication. No user interaction is required and the attack is network-accessible. The vulnerability affects versions 12.2.0–15.5.16 and 16.0.0–16.2.5. Patches were released as Next.js 15.5.16 and 16.2.5, which updated the matcher logic to handle i18n data routes consistently. Workaround: enforce authorization checks in the page's server-side data handler rather than relying solely on middleware.
Affected products
- Vercel Next.js 12.2.0 through 15.5.15, 16.0.0 through 16.2.4
Timeline
- 2026-05-06: disclosed
- 2026-05-06: patched: Next.js 15.5.16 and 16.2.5 released with fix