7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44573

CVE-2026-44573: Next.js: Middleware / Proxy bypass in Pages Router applications using i18n

Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44573

CVE-2026-44573:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
next	npm	>= 12.2.0, < 15.5.16	15.5.16
next	npm	>= 16.0.0, < 16.2.5	16.2.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-36qx-fr4f-26g5, describes a middleware bypass in Next.js applications that use the Pages Router with i18n. Specifically, requests to locale-less data routes (/_next/data/<buildId>/<page>.json) were not being processed by middleware, allowing unauthorized access to page data. The analysis of the patch between vulnerable version 16.2.4 and patched version 16.2.5 revealed a key change in the getResolveRoutes function within packages/next/src/server/lib/router-utils/resolve-routes.ts. The commit cb171d749412b27d1602efdae210c89a30851935 introduces logic to handle cases where a default locale is configured but not present in the request URL. It normalizes the path by prepending the default locale. This ensures that the router correctly identifies the route and, crucially, triggers any associated middleware. The vulnerability's root cause was the absence of this normalization within the getResolveRoutes function, which would be the entry point for this vulnerable logic in a runtime profile.

Vulnerable functions

getResolveRoutes

packages/next/src/server/lib/router-utils/resolve-routes.ts

This function is responsible for resolving request routes. Before the patch, it did not correctly normalize locale-less `/_next/data/...` requests for applications with i18n enabled. This caused the router to fail to match the request to the correct page and its associated middleware, leading to an authorization bypass where middleware was the sole mechanism for protecting the page data. The patch adds logic to normalize the path by prepending the default locale, ensuring middleware is triggered correctly.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.