CVE-2026-44574

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44574
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44574.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44574
Aliases
Downstream
Related
Published
2026-05-13T16:56:06.008Z
Modified
2026-08-15T04:07:22.360846297Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Next.js: Middleware / Proxy bypass through dynamic route parameter injection
Details

Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 15.5.16 and 16.2.5.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-288"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44574.json"
}
References

Affected packages

Git / github.com/vercel/next.js

Affected ranges

Type
GIT
Repo
https://github.com/vercel/next.js
Events
Introduced
7ad467409b67691ae4f5dc4dc47f1a247c4ba988
Fixed
ad6fd4e50e5aba20b60d283c42b89273a3167ccd
Introduced
950609f96f694c5475d18cd2d72a0052ca04d4b9
Fixed
766148f9cd48c0e218acafcd0f15defc14871bf4
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "15.4.0"
        },
        {
            "fixed": "15.5.16"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.2.5"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*"
}

Affected versions

v15.*
v15.4.0
v15.4.1
v15.4.2-canary.0
v15.4.2-canary.1
v15.4.2-canary.10
v15.4.2-canary.11
v15.4.2-canary.12
v15.4.2-canary.13
v15.4.2-canary.14
v15.4.2-canary.15
v15.4.2-canary.16
v15.4.2-canary.17
v15.4.2-canary.18
v15.4.2-canary.19
v15.4.2-canary.2
v15.4.2-canary.20
v15.4.2-canary.21
v15.4.2-canary.22
v15.4.2-canary.23
v15.4.2-canary.24
v15.4.2-canary.25
v15.4.2-canary.26
v15.4.2-canary.27
v15.4.2-canary.28
v15.4.2-canary.29
v15.4.2-canary.3
v15.4.2-canary.30
v15.4.2-canary.31
v15.4.2-canary.32
v15.4.2-canary.33
v15.4.2-canary.34
v15.4.2-canary.35
v15.4.2-canary.36
v15.4.2-canary.37
v15.4.2-canary.38
v15.4.2-canary.39
v15.4.2-canary.4
v15.4.2-canary.40
v15.4.2-canary.41
v15.4.2-canary.42
v15.4.2-canary.43
v15.4.2-canary.44
v15.4.2-canary.45
v15.4.2-canary.46
v15.4.2-canary.47
v15.4.2-canary.48
v15.4.2-canary.49
v15.4.2-canary.5
v15.4.2-canary.50
v15.4.2-canary.51
v15.4.2-canary.52
v15.4.2-canary.53
v15.4.2-canary.54
v15.4.2-canary.55
v15.4.2-canary.56
v15.4.2-canary.6
v15.4.2-canary.7
v15.4.2-canary.8
v15.4.2-canary.9
v15.5.0
v15.5.1
v15.5.10
v15.5.11
v15.5.12
v15.5.13
v15.5.14
v15.5.15
v15.5.2
v15.5.3
v15.5.4
v15.5.5
v15.5.6
v15.5.7
v15.5.8
v15.5.9
v16.*
v16.0.0
v16.0.1
v16.0.1-canary.0
v16.0.1-canary.1
v16.0.1-canary.2
v16.0.1-canary.3
v16.0.1-canary.4
v16.0.1-canary.5
v16.0.1-canary.6
v16.0.2-canary.0
v16.0.2-canary.1
v16.0.2-canary.10
v16.0.2-canary.11
v16.0.2-canary.12
v16.0.2-canary.13
v16.0.2-canary.14
v16.0.2-canary.15
v16.0.2-canary.16
v16.0.2-canary.17
v16.0.2-canary.18
v16.0.2-canary.19
v16.0.2-canary.2
v16.0.2-canary.20
v16.0.2-canary.21
v16.0.2-canary.22
v16.0.2-canary.23
v16.0.2-canary.24
v16.0.2-canary.25
v16.0.2-canary.26
v16.0.2-canary.27
v16.0.2-canary.28
v16.0.2-canary.29
v16.0.2-canary.3
v16.0.2-canary.30
v16.0.2-canary.31
v16.0.2-canary.32
v16.0.2-canary.33
v16.0.2-canary.34
v16.0.2-canary.4
v16.0.2-canary.5
v16.0.2-canary.6
v16.0.2-canary.7
v16.0.2-canary.8
v16.0.2-canary.9
v16.1.0
v16.1.0-canary.0
v16.1.0-canary.1
v16.1.0-canary.10
v16.1.0-canary.11
v16.1.0-canary.12
v16.1.0-canary.13
v16.1.0-canary.14
v16.1.0-canary.15
v16.1.0-canary.16
v16.1.0-canary.17
v16.1.0-canary.18
v16.1.0-canary.19
v16.1.0-canary.2
v16.1.0-canary.20
v16.1.0-canary.21
v16.1.0-canary.22
v16.1.0-canary.23
v16.1.0-canary.24
v16.1.0-canary.25
v16.1.0-canary.26
v16.1.0-canary.27
v16.1.0-canary.28
v16.1.0-canary.29
v16.1.0-canary.3
v16.1.0-canary.30
v16.1.0-canary.31
v16.1.0-canary.32
v16.1.0-canary.33
v16.1.0-canary.34
v16.1.0-canary.4
v16.1.0-canary.5
v16.1.0-canary.6
v16.1.0-canary.7
v16.1.0-canary.8
v16.1.0-canary.9
v16.1.1-canary.0
v16.1.1-canary.1
v16.1.1-canary.10
v16.1.1-canary.11
v16.1.1-canary.12
v16.1.1-canary.13
v16.1.1-canary.14
v16.1.1-canary.15
v16.1.1-canary.16
v16.1.1-canary.17
v16.1.1-canary.18
v16.1.1-canary.19
v16.1.1-canary.2
v16.1.1-canary.20
v16.1.1-canary.21
v16.1.1-canary.22
v16.1.1-canary.23
v16.1.1-canary.24
v16.1.1-canary.25
v16.1.1-canary.26
v16.1.1-canary.27
v16.1.1-canary.28
v16.1.1-canary.29
v16.1.1-canary.3
v16.1.1-canary.30
v16.1.1-canary.31
v16.1.1-canary.32
v16.1.1-canary.33
v16.1.1-canary.34
v16.1.1-canary.35
v16.1.1-canary.36
v16.1.1-canary.4
v16.1.1-canary.5
v16.1.1-canary.6
v16.1.1-canary.7
v16.1.1-canary.8
v16.1.1-canary.9
v16.2.0
v16.2.0-canary.0
v16.2.0-canary.1
v16.2.0-canary.10
v16.2.0-canary.100
v16.2.0-canary.101
v16.2.0-canary.102
v16.2.0-canary.103
v16.2.0-canary.104
v16.2.0-canary.11
v16.2.0-canary.12
v16.2.0-canary.13
v16.2.0-canary.14
v16.2.0-canary.15
v16.2.0-canary.16
v16.2.0-canary.17
v16.2.0-canary.18
v16.2.0-canary.19
v16.2.0-canary.2
v16.2.0-canary.20
v16.2.0-canary.21
v16.2.0-canary.22
v16.2.0-canary.23
v16.2.0-canary.24
v16.2.0-canary.25
v16.2.0-canary.26
v16.2.0-canary.27
v16.2.0-canary.28
v16.2.0-canary.29
v16.2.0-canary.3
v16.2.0-canary.30
v16.2.0-canary.31
v16.2.0-canary.32
v16.2.0-canary.33
v16.2.0-canary.34
v16.2.0-canary.35
v16.2.0-canary.36
v16.2.0-canary.37
v16.2.0-canary.38
v16.2.0-canary.39
v16.2.0-canary.4
v16.2.0-canary.40
v16.2.0-canary.41
v16.2.0-canary.42
v16.2.0-canary.43
v16.2.0-canary.44
v16.2.0-canary.45
v16.2.0-canary.46
v16.2.0-canary.47
v16.2.0-canary.48
v16.2.0-canary.49
v16.2.0-canary.5
v16.2.0-canary.50
v16.2.0-canary.51
v16.2.0-canary.52
v16.2.0-canary.53
v16.2.0-canary.54
v16.2.0-canary.55
v16.2.0-canary.56
v16.2.0-canary.57
v16.2.0-canary.58
v16.2.0-canary.59
v16.2.0-canary.6
v16.2.0-canary.60
v16.2.0-canary.61
v16.2.0-canary.62
v16.2.0-canary.63
v16.2.0-canary.64
v16.2.0-canary.65
v16.2.0-canary.66
v16.2.0-canary.67
v16.2.0-canary.68
v16.2.0-canary.69
v16.2.0-canary.7
v16.2.0-canary.70
v16.2.0-canary.71
v16.2.0-canary.72
v16.2.0-canary.73
v16.2.0-canary.74
v16.2.0-canary.75
v16.2.0-canary.76
v16.2.0-canary.77
v16.2.0-canary.78
v16.2.0-canary.79
v16.2.0-canary.8
v16.2.0-canary.80
v16.2.0-canary.81
v16.2.0-canary.82
v16.2.0-canary.83
v16.2.0-canary.84
v16.2.0-canary.85
v16.2.0-canary.86
v16.2.0-canary.87
v16.2.0-canary.88
v16.2.0-canary.89
v16.2.0-canary.9
v16.2.0-canary.90
v16.2.0-canary.91
v16.2.0-canary.92
v16.2.0-canary.93
v16.2.0-canary.94
v16.2.0-canary.95
v16.2.0-canary.96
v16.2.0-canary.97
v16.2.0-canary.98
v16.2.0-canary.99
v16.2.1
v16.2.2
v16.2.3
v16.2.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44574.json"