Executive brief
Next.js is a popular React framework used to build web applications. Affected versions allow attackers to bypass middleware and proxy-based authorization checks by crafting specially-formatted requests to segment-prefetch routes, potentially exposing protected content without authentication. This could allow unauthorized users to access sensitive pages or data that should be restricted.
Technical details
This is an authentication bypass vulnerability (CWE-288) in Next.js App Router applications. The vulnerability stems from middleware matchers not properly accounting for transport-specific route variants used for segment prefetching. Attackers can craft .rsc and segment-prefetch URLs that resolve to the same protected pages but bypass the intended middleware rules, since these transport variants are not matched by the middleware matcher logic. The attack requires network access and no authentication or user interaction. Vulnerable applications that rely solely on middleware or proxy-based authorization checks are exposed; attackers can access protected content directly. The fix, released in versions 15.5.16 and 16.2.5, includes App Router transport variants when generating middleware matchers to ensure consistent protection across all route variants.
Affected products
- Vercel Next.js >=15.2.0 <15.5.16, >=16.0.0 <16.2.5
Timeline
- 2026-05-06: disclosed
- 2026-05-06: patched: Fixed in v15.5.16 and v16.2.5