tag
Middleware-Bypass
Next.js i18n Middleware Bypass (CVE-2026-44573)
CVE-2026-44573 is an authorization bypass in Next.js Pages Router applications that use the i18n configuration. The middleware matcher regex's i18n branch does not correctly cover all locale-prefix permutations of next/data/<buildId>/<page>.json URLs. As a…
Next.js Dynamic Route Injection Auth Bypass (CVE-2026-44574)
CVE-2026-44574 is an authentication bypass in Next.js App Router applications that use middleware to protect dynamic route pages. Specially crafted query parameters (nxtP / nxtI internal Next.js route params) injected on a public URL cause the App Router…
Next.js App Router Segment-Prefetch Middleware Bypass (CVE-2026-44575)
CVE-2026-44575 is an authorization bypass in Next.js App Router middleware matching. Vulnerable versions compile middleware matchers for canonical paths and legacy Pages Router data routes, but omit the App Router transport variants used for .rsc and…
Next.js Corrupt Middleware Auth Bypass (CVE-2025-29927)
CVE-2025-29927 is a critical authentication bypass in Next.js middleware. By sending a crafted x-middleware-subrequest HTTP header, an unauthenticated remote attacker can cause the Next.js middleware layer to skip execution entirely — bypassing authentication…