7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44575

CVE-2026-44575: Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44575

CVE-2026-44575:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
next	npm	>= 15.2.0, < 15.5.16	15.5.16
next	npm	>= 16.0.0, < 16.2.5	16.2.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Next.js's middleware matching logic, which failed to account for all URL variations generated by the App Router, leading to a bypass of authorization checks. The analysis of the security advisory and the associated patch confirms that the getMiddlewareMatchers function in packages/next/src/build/analysis/get-page-static-info.ts was the source of this vulnerability. The commit d166096c399c4fc4e09cd2d1bf26dca6579a855d directly addresses this issue by modifying the regex generation within this function to correctly identify and match App Router's transport-specific URLs, such as those for RSC (React Server Components) and segment prefetching. By adding these variants to the matching logic, the middleware can now correctly intercept and apply security policies to all relevant requests, thus closing the bypass vulnerability. The vulnerable function getMiddlewareMatchers is the key runtime indicator, as it is directly responsible for the flawed logic that was exploited.

Vulnerable functions

getMiddlewareMatchers

packages/next/src/build/analysis/get-page-static-info.ts

The `getMiddlewareMatchers` function is responsible for generating regular expressions that match incoming requests against middleware rules. Before the patch, this function did not correctly account for all possible URL variations used by the App Router, specifically transport-specific routes like those ending in `.rsc` or segment-prefetch URLs (e.g., `.../segments/.../....segment.rsc`). As a result, a specially crafted URL could bypass the middleware's authorization checks, allowing unauthorized access to protected pages. The patch corrects this by extending the generated regular expressions to include these App Router-specific URL patterns.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.