CVE-2026-44574: Vercel Next.js authorization bypass in dynamic route middleware

CVE-2026-44574 · Severity: high · CVSS 8.1 · Published 2026-05-13

Next.js is a popular React framework used to build web applications. Applications using Next.js middleware to protect sensitive pages can be bypassed by attackers who craft special query parameters that trick the application into serving protected content without enforcing access controls. This could allow unauthorized users to view sensitive data or perform restricted actions.

Technologies: Red Hat Enterprise Linux AI, Red Hat Trusted Artifact Signer, Red Hat Streams for Apache Kafka, Vercel Next.js. Vendors: Red Hat, Vercel.

Quick answers

Is CVE-2026-44574 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44574 being exploited in the wild.
How severe is CVE-2026-44574?
High severity, with a CVSS score of 8.1, published 13 May 2026.
Which products and versions are affected?
Vercel Next.js >= 15.4.0, < 15.5.16, >= 15.4.0, < 15.5.16; >= 16.0.0, < 16.2.5, 15.4.0 to 15.5.15, 16.0.0 to 16.2.4.
Is there a fix for CVE-2026-44574?
A patch was published on 2026-05-06: Fixed in versions 15.5.16 and 16.2.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44574 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-44574?
Check whether you run Red Hat Enterprise Linux AI, Red Hat Trusted Artifact Signer, Red Hat Streams for Apache Kafka or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an authentication bypass (CWE-288) affecting Next.js versions 15.4.0–15.5.15 and 16.0.0–16.2.4. The root cause is improper handling of dynamic route parameter normalization: externally supplied parameter encodings in query strings can alter how the page interprets the dynamic route value, bypassing middleware security checks that rely on path matching. The attack requires network access and low privileges (an ordinary unauthenticated request), with no user interaction necessary. An attacker can craft a request with malicious query parameters to access protected routes without triggering the middleware that should enforce authorization. Patches were released in versions 15.5.16 and 16.2.5, which restrict internal route-parameter normalization to trusted routing flows only.

Affected products

  • Vercel Next.js 15.4.0 to 15.5.15, 16.0.0 to 16.2.4

Identifiers

  • CVE-2026-44574
  • GHSA-492v-c6pp-mqqv

Timeline

  • 2026-05-06: disclosed
  • 2026-05-06: patched: Fixed in versions 15.5.16 and 16.2.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.