CVE-2026-44573
Full vulnerability record from the local CVENow database.
Description
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.
Severity
HIGH
CVSS score
7.5
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-05-13 17:16:22.627000
Last modified
2026-10-26 17:10:03.270000
View original CVE JSON
{
"id": "CVE-2026-44573",
"sourceIdentifier": "[email protected]",
"published": "2026-05-13T17:16:22.627",
"lastModified": "2026-10-26T17:10:03.270",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5."
},
{
"lang": "es",
"value": "Next.js es un framework de React para construir aplicaciones web full-stack. Desde 12.2.0 hasta antes de 15.5.16 y 16.2.5, las aplicaciones que usan el Pages Router con i18n configurado y autorización basada en middleware/proxy pueden permitir acceso no autorizado a datos de páginas protegidas a través de solicitudes /_next/data/[buildId]/[page].json sin configuración regional. En configuraciones afectadas, el middleware no se ejecuta para la ruta de datos sin prefijo, permitiendo a un atacante recuperar JSON SSR para páginas protegidas sin pasar las comprobaciones de autorización previstas. Esta vulnerabilidad está corregida en 15.5.16 y 16.2.5."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "vercel",
"product": "next.js",
"versions": [
{
"version": ">= 12.2.0, < 15.5.16",
"status": "affected"
},
{
"version": ">= 16.0.0, < 16.2.5",
"status": "affected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Streams for Apache Kafka 2.9.4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "next",
"cpes": [
"cpe:/a:redhat:amq_streams:2.9::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Trusted Artifact Signer 1.3",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhtas/rekor-search-ui-rhel9",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
],
"versions": [
{
"version": "1783958622",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Trusted Artifact Signer 1.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhtas/rekor-search-ui-rhel9",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
],
"versions": [
{
"version": "1783327185",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "firefox",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "thunderbird",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "firefox",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "firefox",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "thunderbird",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "firefox",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "thunderbird",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-gaudi-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-rocm-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/disk-image-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "streams for Apache Kafka 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "next",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-13T18:10:30.422168Z",
"id": "CVE-2026-44573",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-551"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "12.2.0",
"versionEndExcluding": "15.5.16",
"matchCriteriaId": "31A12CFA-9A52-4285-B5F3-E5FAD69DF477"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "16.0.0",
"versionEndExcluding": "16.2.5",
"matchCriteriaId": "27C5CF7A-7A33-4BE4-B8FD-10BFD813204A"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34608",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:37272",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:40974",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:54435",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-44573",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477199",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44573.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}