CVE-2026-44575

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44575
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44575.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44575
Aliases
Downstream
Related
Published
2026-05-13T16:54:39.455Z
Modified
2026-08-15T04:06:58.696484797Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Details

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-288"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44575.json"
}
References

Affected packages

Git / github.com/vercel/next.js

Affected ranges

Type
GIT
Repo
https://github.com/vercel/next.js
Events
Introduced
b0416fbb44d1d148b6322ed79b6448d588260e49
Fixed
ad6fd4e50e5aba20b60d283c42b89273a3167ccd
Introduced
950609f96f694c5475d18cd2d72a0052ca04d4b9
Fixed
766148f9cd48c0e218acafcd0f15defc14871bf4
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "15.2.0"
        },
        {
            "fixed": "15.5.16"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.2.5"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*"
}

Affected versions

v15.*
v15.2.0
v15.2.1
v15.2.1-canary.0
v15.2.1-canary.1
v15.2.1-canary.2
v15.2.1-canary.3
v15.2.1-canary.4
v15.2.1-canary.5
v15.2.1-canary.6
v15.2.2-canary.0
v15.2.2-canary.1
v15.2.2-canary.2
v15.2.2-canary.3
v15.2.2-canary.4
v15.2.2-canary.5
v15.2.2-canary.6
v15.2.2-canary.7
v15.3.0
v15.3.0-canary.0
v15.3.0-canary.1
v15.3.0-canary.10
v15.3.0-canary.11
v15.3.0-canary.12
v15.3.0-canary.13
v15.3.0-canary.14
v15.3.0-canary.15
v15.3.0-canary.16
v15.3.0-canary.17
v15.3.0-canary.18
v15.3.0-canary.19
v15.3.0-canary.2
v15.3.0-canary.20
v15.3.0-canary.21
v15.3.0-canary.22
v15.3.0-canary.23
v15.3.0-canary.24
v15.3.0-canary.25
v15.3.0-canary.26
v15.3.0-canary.27
v15.3.0-canary.28
v15.3.0-canary.29
v15.3.0-canary.3
v15.3.0-canary.30
v15.3.0-canary.31
v15.3.0-canary.32
v15.3.0-canary.33
v15.3.0-canary.34
v15.3.0-canary.35
v15.3.0-canary.36
v15.3.0-canary.37
v15.3.0-canary.38
v15.3.0-canary.39
v15.3.0-canary.4
v15.3.0-canary.40
v15.3.0-canary.41
v15.3.0-canary.42
v15.3.0-canary.43
v15.3.0-canary.44
v15.3.0-canary.45
v15.3.0-canary.46
v15.3.0-canary.5
v15.3.0-canary.6
v15.3.0-canary.7
v15.3.0-canary.8
v15.3.0-canary.9
v15.3.1-canary.0
v15.3.1-canary.1
v15.3.1-canary.10
v15.3.1-canary.11
v15.3.1-canary.12
v15.3.1-canary.13
v15.3.1-canary.14
v15.3.1-canary.15
v15.3.1-canary.2
v15.3.1-canary.3
v15.3.1-canary.4
v15.3.1-canary.5
v15.3.1-canary.6
v15.3.1-canary.7
v15.3.1-canary.8
v15.3.1-canary.9
v15.4.0
v15.4.0-canary.0
v15.4.0-canary.1
v15.4.0-canary.10
v15.4.0-canary.100
v15.4.0-canary.101
v15.4.0-canary.102
v15.4.0-canary.103
v15.4.0-canary.104
v15.4.0-canary.105
v15.4.0-canary.107
v15.4.0-canary.108
v15.4.0-canary.109
v15.4.0-canary.11
v15.4.0-canary.110
v15.4.0-canary.111
v15.4.0-canary.112
v15.4.0-canary.113
v15.4.0-canary.114
v15.4.0-canary.115
v15.4.0-canary.116
v15.4.0-canary.117
v15.4.0-canary.118
v15.4.0-canary.119
v15.4.0-canary.12
v15.4.0-canary.120
v15.4.0-canary.121
v15.4.0-canary.122
v15.4.0-canary.123
v15.4.0-canary.124
v15.4.0-canary.125
v15.4.0-canary.126
v15.4.0-canary.127
v15.4.0-canary.128
v15.4.0-canary.129
v15.4.0-canary.13
v15.4.0-canary.130
v15.4.0-canary.14
v15.4.0-canary.15
v15.4.0-canary.16
v15.4.0-canary.17
v15.4.0-canary.18
v15.4.0-canary.19
v15.4.0-canary.2
v15.4.0-canary.20
v15.4.0-canary.21
v15.4.0-canary.22
v15.4.0-canary.23
v15.4.0-canary.24
v15.4.0-canary.25
v15.4.0-canary.26
v15.4.0-canary.27
v15.4.0-canary.28
v15.4.0-canary.29
v15.4.0-canary.3
v15.4.0-canary.30
v15.4.0-canary.31
v15.4.0-canary.32
v15.4.0-canary.33
v15.4.0-canary.34
v15.4.0-canary.35
v15.4.0-canary.36
v15.4.0-canary.37
v15.4.0-canary.38
v15.4.0-canary.39
v15.4.0-canary.4
v15.4.0-canary.40
v15.4.0-canary.42
v15.4.0-canary.43
v15.4.0-canary.45
v15.4.0-canary.46
v15.4.0-canary.48
v15.4.0-canary.49
v15.4.0-canary.5
v15.4.0-canary.50
v15.4.0-canary.51
v15.4.0-canary.52
v15.4.0-canary.53
v15.4.0-canary.54
v15.4.0-canary.55
v15.4.0-canary.56
v15.4.0-canary.57
v15.4.0-canary.58
v15.4.0-canary.59
v15.4.0-canary.6
v15.4.0-canary.60
v15.4.0-canary.61
v15.4.0-canary.62
v15.4.0-canary.63
v15.4.0-canary.64
v15.4.0-canary.65
v15.4.0-canary.66
v15.4.0-canary.67
v15.4.0-canary.68
v15.4.0-canary.69
v15.4.0-canary.7
v15.4.0-canary.70
v15.4.0-canary.71
v15.4.0-canary.72
v15.4.0-canary.73
v15.4.0-canary.74
v15.4.0-canary.75
v15.4.0-canary.76
v15.4.0-canary.77
v15.4.0-canary.78
v15.4.0-canary.79
v15.4.0-canary.8
v15.4.0-canary.80
v15.4.0-canary.81
v15.4.0-canary.82
v15.4.0-canary.83
v15.4.0-canary.84
v15.4.0-canary.85
v15.4.0-canary.86
v15.4.0-canary.87
v15.4.0-canary.88
v15.4.0-canary.89
v15.4.0-canary.9
v15.4.0-canary.90
v15.4.0-canary.91
v15.4.0-canary.92
v15.4.0-canary.93
v15.4.0-canary.94
v15.4.0-canary.95
v15.4.0-canary.96
v15.4.0-canary.97
v15.4.0-canary.98
v15.4.0-canary.99
v15.4.1
v15.4.2-canary.0
v15.4.2-canary.1
v15.4.2-canary.10
v15.4.2-canary.11
v15.4.2-canary.12
v15.4.2-canary.13
v15.4.2-canary.14
v15.4.2-canary.15
v15.4.2-canary.16
v15.4.2-canary.17
v15.4.2-canary.18
v15.4.2-canary.19
v15.4.2-canary.2
v15.4.2-canary.20
v15.4.2-canary.21
v15.4.2-canary.22
v15.4.2-canary.23
v15.4.2-canary.24
v15.4.2-canary.25
v15.4.2-canary.26
v15.4.2-canary.27
v15.4.2-canary.28
v15.4.2-canary.29
v15.4.2-canary.3
v15.4.2-canary.30
v15.4.2-canary.31
v15.4.2-canary.32
v15.4.2-canary.33
v15.4.2-canary.34
v15.4.2-canary.35
v15.4.2-canary.36
v15.4.2-canary.37
v15.4.2-canary.38
v15.4.2-canary.39
v15.4.2-canary.4
v15.4.2-canary.40
v15.4.2-canary.41
v15.4.2-canary.42
v15.4.2-canary.43
v15.4.2-canary.44
v15.4.2-canary.45
v15.4.2-canary.46
v15.4.2-canary.47
v15.4.2-canary.48
v15.4.2-canary.49
v15.4.2-canary.5
v15.4.2-canary.50
v15.4.2-canary.51
v15.4.2-canary.52
v15.4.2-canary.53
v15.4.2-canary.54
v15.4.2-canary.55
v15.4.2-canary.56
v15.4.2-canary.6
v15.4.2-canary.7
v15.4.2-canary.8
v15.4.2-canary.9
v15.5.0
v15.5.1
v15.5.10
v15.5.11
v15.5.12
v15.5.13
v15.5.14
v15.5.15
v15.5.2
v15.5.3
v15.5.4
v15.5.5
v15.5.6
v15.5.7
v15.5.8
v15.5.9
v16.*
v16.0.0
v16.0.1
v16.0.1-canary.0
v16.0.1-canary.1
v16.0.1-canary.2
v16.0.1-canary.3
v16.0.1-canary.4
v16.0.1-canary.5
v16.0.1-canary.6
v16.0.2-canary.0
v16.0.2-canary.1
v16.0.2-canary.10
v16.0.2-canary.11
v16.0.2-canary.12
v16.0.2-canary.13
v16.0.2-canary.14
v16.0.2-canary.15
v16.0.2-canary.16
v16.0.2-canary.17
v16.0.2-canary.18
v16.0.2-canary.19
v16.0.2-canary.2
v16.0.2-canary.20
v16.0.2-canary.21
v16.0.2-canary.22
v16.0.2-canary.23
v16.0.2-canary.24
v16.0.2-canary.25
v16.0.2-canary.26
v16.0.2-canary.27
v16.0.2-canary.28
v16.0.2-canary.29
v16.0.2-canary.3
v16.0.2-canary.30
v16.0.2-canary.31
v16.0.2-canary.32
v16.0.2-canary.33
v16.0.2-canary.34
v16.0.2-canary.4
v16.0.2-canary.5
v16.0.2-canary.6
v16.0.2-canary.7
v16.0.2-canary.8
v16.0.2-canary.9
v16.1.0
v16.1.0-canary.0
v16.1.0-canary.1
v16.1.0-canary.10
v16.1.0-canary.11
v16.1.0-canary.12
v16.1.0-canary.13
v16.1.0-canary.14
v16.1.0-canary.15
v16.1.0-canary.16
v16.1.0-canary.17
v16.1.0-canary.18
v16.1.0-canary.19
v16.1.0-canary.2
v16.1.0-canary.20
v16.1.0-canary.21
v16.1.0-canary.22
v16.1.0-canary.23
v16.1.0-canary.24
v16.1.0-canary.25
v16.1.0-canary.26
v16.1.0-canary.27
v16.1.0-canary.28
v16.1.0-canary.29
v16.1.0-canary.3
v16.1.0-canary.30
v16.1.0-canary.31
v16.1.0-canary.32
v16.1.0-canary.33
v16.1.0-canary.34
v16.1.0-canary.4
v16.1.0-canary.5
v16.1.0-canary.6
v16.1.0-canary.7
v16.1.0-canary.8
v16.1.0-canary.9
v16.1.1-canary.0
v16.1.1-canary.1
v16.1.1-canary.10
v16.1.1-canary.11
v16.1.1-canary.12
v16.1.1-canary.13
v16.1.1-canary.14
v16.1.1-canary.15
v16.1.1-canary.16
v16.1.1-canary.17
v16.1.1-canary.18
v16.1.1-canary.19
v16.1.1-canary.2
v16.1.1-canary.20
v16.1.1-canary.21
v16.1.1-canary.22
v16.1.1-canary.23
v16.1.1-canary.24
v16.1.1-canary.25
v16.1.1-canary.26
v16.1.1-canary.27
v16.1.1-canary.28
v16.1.1-canary.29
v16.1.1-canary.3
v16.1.1-canary.30
v16.1.1-canary.31
v16.1.1-canary.32
v16.1.1-canary.33
v16.1.1-canary.34
v16.1.1-canary.35
v16.1.1-canary.36
v16.1.1-canary.4
v16.1.1-canary.5
v16.1.1-canary.6
v16.1.1-canary.7
v16.1.1-canary.8
v16.1.1-canary.9
v16.2.0
v16.2.0-canary.0
v16.2.0-canary.1
v16.2.0-canary.10
v16.2.0-canary.100
v16.2.0-canary.101
v16.2.0-canary.102
v16.2.0-canary.103
v16.2.0-canary.104
v16.2.0-canary.11
v16.2.0-canary.12
v16.2.0-canary.13
v16.2.0-canary.14
v16.2.0-canary.15
v16.2.0-canary.16
v16.2.0-canary.17
v16.2.0-canary.18
v16.2.0-canary.19
v16.2.0-canary.2
v16.2.0-canary.20
v16.2.0-canary.21
v16.2.0-canary.22
v16.2.0-canary.23
v16.2.0-canary.24
v16.2.0-canary.25
v16.2.0-canary.26
v16.2.0-canary.27
v16.2.0-canary.28
v16.2.0-canary.29
v16.2.0-canary.3
v16.2.0-canary.30
v16.2.0-canary.31
v16.2.0-canary.32
v16.2.0-canary.33
v16.2.0-canary.34
v16.2.0-canary.35
v16.2.0-canary.36
v16.2.0-canary.37
v16.2.0-canary.38
v16.2.0-canary.39
v16.2.0-canary.4
v16.2.0-canary.40
v16.2.0-canary.41
v16.2.0-canary.42
v16.2.0-canary.43
v16.2.0-canary.44
v16.2.0-canary.45
v16.2.0-canary.46
v16.2.0-canary.47
v16.2.0-canary.48
v16.2.0-canary.49
v16.2.0-canary.5
v16.2.0-canary.50
v16.2.0-canary.51
v16.2.0-canary.52
v16.2.0-canary.53
v16.2.0-canary.54
v16.2.0-canary.55
v16.2.0-canary.56
v16.2.0-canary.57
v16.2.0-canary.58
v16.2.0-canary.59
v16.2.0-canary.6
v16.2.0-canary.60
v16.2.0-canary.61
v16.2.0-canary.62
v16.2.0-canary.63
v16.2.0-canary.64
v16.2.0-canary.65
v16.2.0-canary.66
v16.2.0-canary.67
v16.2.0-canary.68
v16.2.0-canary.69
v16.2.0-canary.7
v16.2.0-canary.70
v16.2.0-canary.71
v16.2.0-canary.72
v16.2.0-canary.73
v16.2.0-canary.74
v16.2.0-canary.75
v16.2.0-canary.76
v16.2.0-canary.77
v16.2.0-canary.78
v16.2.0-canary.79
v16.2.0-canary.8
v16.2.0-canary.80
v16.2.0-canary.81
v16.2.0-canary.82
v16.2.0-canary.83
v16.2.0-canary.84
v16.2.0-canary.85
v16.2.0-canary.86
v16.2.0-canary.87
v16.2.0-canary.88
v16.2.0-canary.89
v16.2.0-canary.9
v16.2.0-canary.90
v16.2.0-canary.91
v16.2.0-canary.92
v16.2.0-canary.93
v16.2.0-canary.94
v16.2.0-canary.95
v16.2.0-canary.96
v16.2.0-canary.97
v16.2.0-canary.98
v16.2.0-canary.99
v16.2.1
v16.2.2
v16.2.3
v16.2.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44575.json"