Next.js Vulnerability Exposes Protected Data via Pages Router

The National Vulnerability Database has detailed CVE-2026-44573, a high-severity vulnerability (CVSS 7.5) affecting Next.js applications using the Pages Router. Specifically, versions from 12.2.0 up to, but not including, 15.5.16 and 16.2.5 are vulnerable when configured with i18n and middleware/proxy-based authorization. This flaw allows unauthorized access to protected page data.

The core issue, as described by the National Vulnerability Database, lies in how Next.js handles locale-less /_next/data/<buildId>/<page>.json requests. Under these specific conditions, the middleware responsible for authorization checks simply doesn’t execute for the unprefixed data route. This bypass allows an attacker to fetch server-side rendered (SSR) JSON data for pages that should otherwise be protected by the intended authorization mechanisms.

This is a critical bypass. Attackers can directly retrieve sensitive information that organizations believed was secured behind authentication. The National Vulnerability Database confirms that the vulnerability is fixed in Next.js versions 15.5.16 and 16.2.5. Organizations running affected versions must prioritize upgrading immediately to close this authorization gap.