PT-2026-39409 · Vercel · Next.Js

Tim Neutkens + 1 · Published 2026-05-09 · Updated 2026-05-14 · CVE-2026-44575

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Next.js versions 15.2.0 through 15.5.15 Next.js versions 16.0.0 through 16.2.4

Description App Router applications using middleware or proxy-based authorization checks may allow unauthorized access via transport-specific route variants used for segment prefetching. Specially crafted .rsc and segment-prefetch URLs can resolve to the same page without triggering the intended middleware rule, enabling access to protected content without authorization checks.

Recommendations Update to version 15.5.16. Update to version 16.2.5. Enforce authorization in the underlying route or page logic instead of relying solely on middleware.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-44575

GHSA-267C-6GRR-H53F

Affected Products

Next.Js

References · 12

• https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44575 · Security Note
• https://osv.dev/vulnerability/GHSA-267c-6grr-h53f · Vendor Advisory
• https://github.com/vercel/next.js/releases/tag/v15.5.16 · Note
• https://github.com/vercel/next.js/releases/tag/v16.2.5 · Note
• https://github.com/vercel/next.js · Note
• https://reddit.com/r/CVEWatch/comments/1tbv4l3/top_10_trending_cves_13052026 · Reddit Post
• https://twitter.com/HackingTeam77/status/2053157851128807882 · Twitter Post
• https://t.me/cveNotify/163435 · Telegram Post
• https://t.me/brutsecurity/2701 · Telegram Post
• https://twitter.com/UpwindMDR/status/2053879564124778970 · Twitter Post
• https://t.me/proxy_bar/3371 · Telegram Post