Next.js Middleware Bypass (CVE-2026-44574) Exposes Dynamic Routes

The National Vulnerability Database has issued an advisory for CVE-2026-44574, a high-severity authorization bypass vulnerability in Next.js. Affecting versions 15.4.0 to before 15.5.16 and 16.2.5, this flaw allows attackers to circumvent middleware protection on dynamic routes. By crafting specific query parameters, an attacker can alter the route value seen by the page rendering logic, effectively bypassing expected middleware checks while the visible URL remains unchanged.

This vulnerability, scored 8.1 (HIGH) on the CVSS scale, is a critical issue for applications relying on Next.js middleware for access control. The core problem lies in how specially crafted input manipulates the internal routing mechanism, leading to an information disclosure and potential unauthorized access to protected content. The National Vulnerability Database indicates that the vulnerability is fixed in Next.js versions 15.5.16 and 16.2.5.

From an attacker’s perspective, this is gold. It’s a precise bypass that targets the very mechanism meant to enforce authorization. Defenders need to understand that simply having middleware in place isn’t enough; the implementation details, especially around dynamic route parsing, are where the cracks appear. Patching is non-negotiable, but a deeper look into how your Next.js application handles dynamic routing and query parameters is essential to prevent similar logic flaws.